VulnSocial

CVE-2026-90467Disclosure

LOWCVSS 6.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-88

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-12); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-12: 1Mentions · 2026-09-18: 1Patch / Workaround · 2026-09-18: 1Technical Details · 2026-09-12: 1Technical Details · 2026-09-18: 109-1209-18
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-121
Disclosure1
2026-09-181
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-90467 aiosmtplib before 5.1.3: ESMTP parameter injection via MAIL FROM/RCPT TO, forged auth and forced notifications. CVSS 4.0, no patch confirmed. Update to 5.1.3+ now. https://www.valtersit.com/cve/CVE-2026-90467/ #CVE #infosec #cybersecurity #CVE #infosec #XSS #valtersit #snippet #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses an ESMTP parameter injection flaw in aiosmtplib prior to version 5.1.3, provides CVSS 4.0 details, and urges updating to 5.1.3+ for remediation.

    0000036
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-90467 aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO comma… https://www.cve.org/CVERecord?id=CVE-2026-90467

    Post summary

    The update notes that CVE-2026-90467 involves a validation flaw in aiosmtplib allowing ESMTP injection, but it gives no evidence of exploitation, PoC, or patch.

    00000639
    58.1K followersView on X

Explore more

Back to dashboard