Arbitrary Argument Injection Affecting aiosmtplib package, versions [,5.1.3)

aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio.

Affected versions of this package are vulnerable to Arbitrary Argument Injection in the parse_address() function of src/aiosmtplib/email.py, which returns parsed_address or address.strip(), so a malformed mailbox that email.utils.parseaddr() reduces to ('', '') can access the raw attacker string and quote_address() wraps it verbatim in angle brackets. An attacker can smuggle space-delimited ESMTP parameters onto a single MAIL FROM or RCPT TO line, which the receiving server tokenizes off the address as genuine parameters, by supplying an address containing spaces and angle brackets, producing wire output such as MAIL FROM:<victim@example.com> AUTH=admin@corp.example <> or RCPT TO:<a@b.example> NOTIFY=SUCCESS,FAILURE ORCPT=rfc822;third@party.example>.

Two conditions must both be met to be vulnerable:

• The application passes the attacker-controlled address directly to sender/recipients or mail()/rcpt() without its own format validation.

• The target server implements the injected extension rather than rejecting the malformed mailbox token.

The injection is confined to the parameter layer of that one command line, since CR, LF, NUL, and the remaining C0 controls are already rejected by COMMAND_INJECTION_REGEX ([\x00-\x1f\x7f]), leaving no path to command splitting, header splitting, or message body injection. The message-header path is largely self-neutralizing, because extract_recipients via email.utils.getaddresses() collapses an injected To: value to ['a@b.example', '<>'] and discards the injected structure, so a clean injection survives only on the direct-argument path.

• GitHub Commit
• GitHub Release
• Vulnerable Code