Email::Sender::Transport::Sendmail versions before 2.602 on Windows build a single shell command that includes the envelope sender and all recipient addresses from the message headers. Because that command is passed directly to the operating system shell with no filtering, an attacker who can control any of those header fields can inject shell metacharacters and cause the transport to execute arbitrary commands. This is a classic command‑injection weakness described by CWE‑78, giving the attacker control over the Perl process executing the sendmail transport.

The flaw affects systems that use the Perl module Email::Sender with the Sendmail transport on Windows where the application builds the command string from header values. Versions of the module older than 2.602 are vulnerable. Any deployment that relies on the default behavior of Email::Sender::Simple, which pulls envelope information from the To, Cc, or From headers, is exposed because those values may be untrusted. No additional version details are provided beyond the pre‑2.602 cutoff.

The CVSS score of 9.8 marks this a critical vulnerability. The EPSS score is reported as less than 1%, indicating that exploitation events are currently uncommon but not impossible. The vulnerability is not listed in the CISA KEV catalog. Because an attacker needs only to send a crafted message with malicious header values, the attack path is straightforward: the message is parsed, the command string is assembled, and the shell executes the injected payload, allowing the attacker to run arbitrary commands under the privileges of the user running the Perl script.