Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-93012: Perl Email Sender library can run attacker commands on Windows

CVE-2026-93012 · published 28 days ago

Summary

The Email::Sender::Transport::Sendmail module for Perl (versions before 2.602) builds a single command line that includes the sender and recipient addresses and passes it to the Windows command shell. If an attacker can control any of those email headers, they can cause the program to execute arbitrary commands with the same rights as the sending process. Update the library to version 2.602 or later, or apply any available patches, to stop the command from being built in this unsafe way.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:16.04:LTS	canonical	libemail-sender-perl	All versions

Original advisory text

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header. An attacker who controls one of those header addresses runs commands as the sending process.

References

https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1... Third Party Advisory
https://metacpan.org/release/RJBS/Email-Sender-2.602/changes Third Party Advisory
https://cpan.org/modules URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93012... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-93012 Vendor Advisory
https://github.com/rjbs/Email-Sender Product
https://ubuntu.com/security/CVE-2026-93012 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-93012 Third Party Advisory
https://lists.security.metacpan.org/cve-announce/msg/43733017/ Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/09/21/8 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published21 Sep 2026

Updated19 Oct 2026

First seen21 Sep 2026

Sources

CVE-2026-93012 · NVD

CVE-2026-93012 · MITRE

CVE-2026-93012 · OSV

UBUNTU-CVE-2026-93012 · OSV

Track software like this

Free during beta