AIKIDO-2026-574584

TL;DR

aiosmtplib builds the MAIL FROM, RCPT TO, VRFY, EXPN and sendmail command lines from caller supplied addresses, and parse_address accepts values containing whitespace or angle brackets outside a quoted local part. An address such as user@example.com> AUTH=<attacker@example.com smuggles additional tokens onto the envelope command line. This lets callers append ESMTP parameters such as AUTH, NOTIFY or ORCPT, forging authenticated identities or redirecting delivery notifications to third parties. The fix validates every address and rejects these characters before any command is sent.