PUBLISHED
2026-09-21 18:17
MODIFIED
2026-09-21 18:17
EPSS (Prob. Exploit)
0.60%
Top 52.1%
> DESCRIPTION
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe.
On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header.
An attacker who controls one of those header addresses runs commands as the sending process.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe
AFFECTED PACKAGES:
Unknown / Unknown
63 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
21/09/2026 18:17
Source: NVD
📊
ENRICHISSEMENT
01/10/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - The product constructs all or part of an OS command using externally-influenced input from an upstr...
Total des modifications: 1
Dernière mise à jour: 3 weeks ago