Aiosmtplib allows an attacker who can influence the envelope sender or recipient addresses to inject carriage return and line feed characters into those values. The library forwards these characters to the SMTP server as new command lines, enabling injection of commands such as MAIL FROM, RCPT TO, DATA, or AUTH. This can desynchronize the command-response pipeline, cause the SMTP client to hang, or allow an attacker to send arbitrary messages without control over the SMTP server. The weakness is a classic command injection flaw, represented by CWE-77 and CWE-93.

The affected product is the aiosmtplib asynchronous SMTP client developed by cole. Versions prior to 5.1.1 expose the vulnerability through the SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() methods and any high‑level sendmail or send calls that pass raw addresses. The library’s send_message() method remains unaffected. The primary users are projects that construct envelope addresses from untrusted input.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack requires that the attacker can influence the email address fields used in SMTP transactions; the exact vector depends on how the client library is integrated, which is inferred rather than explicitly stated in the data. Once the attacker can inject CR/LF, the vulnerability can be exploited to inject arbitrary SMTP commands, potentially compromising the confidentiality, integrity, or availability of messages sent through the client.