CVE-2026-93012: Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

Email::Sender::Transport::Sendmail before version 2.602 builds its sendmail command on Windows (MSWin32) by concatenating the envelope sender and every recipient into a single string that open() passes to a shell, allowing OS command injection (CWE-78). An attacker who controls an envelope address can run arbitrary commands as the user owning the sending process; if the caller supplies no envelope, Email::Sender::Simple derives the sender from the From header and recipients from the To and Cc headers, so attacker-influenced message headers alone may be enough. Only Windows deployments are affected — every other platform uses the safe list-form invocation that runs sendmail directly. Exploitation requires an application to send mail through this transport with an address that is not fully controlled or sanitized. No CVSS score has been assigned, the issue is not in CISA's KEV, and no public PoC or known in-the-wild exploitation exists.