AIKIDO-2026-10419

TL;DR

Affected versions of this package allowed RFC 2047 encoded-word input to be misinterpreted as a valid email address during parser re-processing, letting bare decoded text like test@evil.co be accepted as an address instead of only as a display name. An attacker could exploit this by crafting encoded email header values that bypass expected address formatting rules, potentially injecting or spoofing recipient/sender addresses in systems that trust the parser’s output. The fix restricts re-parsing to properly delimited addresses in angle brackets, preventing fabricated bare-address decoding from being treated as legitimate mailbox data.