AIKIDO-2026-11095

TL;DR

The SMTP protocol layer writes caller-supplied envelope addresses from mail(), rcpt(), vrfy(), expn(), and sendmail() directly onto the control connection without rejecting embedded C0 control characters or DEL. An attacker who can influence those address strings can inject additional SMTP command lines such as RCPT TO or DATA, smuggling a full transaction or desynchronizing the client session. The patch validates all command arguments in execute_command() and raises ValueError before any bytes are sent.