AI analysis
Email::Sender::Transport::Sendmail before version 2.602 builds its sendmail command on Windows (MSWin32) by concatenating the envelope sender and every recipient into a single string that open() passes to a shell, allowing OS command injection (CWE-78). An attacker who controls an envelope address can run arbitrary commands as the user owning the sending process; if the caller supplies no envelope, Email::Sender::Simple derives the sender from the From header and recipients from the To and Cc headers, so attacker-influenced message headers alone may be enough. Only Windows deployments are affected — every other platform uses the safe list-form invocation that runs sendmail directly. Exploitation requires an application to send mail through this transport with an address that is not fully controlled or sanitized. No CVSS score has been assigned, the issue is not in CISA's KEV, and no public PoC or known in-the-wild exploitation exists.
What to do: Upgrade Email::Sender::Transport::Sendmail to 2.602 or later. On Windows, prefer Email::Sender's SMTP transport over the Sendmail transport, and always pass an explicit, validated envelope sender and recipients instead of letting Email::Sender::Simple copy them from From/To/Cc headers. Audit any code path where user-supplied email addresses reach this transport's send path, and review Windows hosts running Perl mail-sending jobs for unexpected shell or sendmail child processes.
Affected
| Perl (CPAN) — Email::Sender project Email::Sender::Transport::Sendmail | before 2.602 (vulnerable only on Windows / MSWin32; other platforms use the safe list-form invocation) |
Estimated exposure
nichelikely low thousands of hosts or fewer; no reliable count (Perl-on-Windows apps using the Sendmail transport) — Email::Sender is a common CPAN dependency, but the vulnerable path requires the uncommon combination of Perl running on Windows and using the Sendmail transport (rather than SMTP), and no public scan or install data covers this; treat as…
Description
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header. An attacker who controls one of those header addresses runs commands as the sending process.