CVE-2026-93012 Details
Description
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header. An attacker who controls one of those header addresses runs commands as the sending process.
A vulnerability in Email::Sender::Transport::Sendmail for Perl, affecting versions prior to 2.602, allows arbitrary command execution on Windows. This occurs when a message is sent with an envelope address that reaches the shell in the _sendmail_pipe function. On Windows, the envelope sender and all recipient addresses are combined into a single command string, which is then executed by the shell. In contrast, other platforms pass the addresses directly to the sendmail program without shell intervention. When no envelope is specified, Email::Sender::Simple uses the To and Cc headers for recipients and the From header for the sender. An attacker controlling one of these header addresses can execute commands as the process sending the email.
Upgrade to Email::Sender::Transport::Sendmail version 2.602 or later. For Windows deployments that cannot upgrade, use a transport that does not build a command line, such as Email::Sender::Transport::SMTP.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c.patch | CPANSec | Source Code |
| https://metacpan.org/release/RJBS/Email-Sender-2.602/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/09/21/8 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Email::Sender::Transport::Sendmail | < 2.602 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | CVE Modified | CVE |
| Sep 21, 2026 | New CVE Received | CPANSec |