As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-93012: Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe
Email::Sender::Transport::Sendmail versions before 2.602 for Perl contain a command injection vulnerability where envelope addresses are passed unsanitized to the shell in the _sendmail_pipe function. An attacker can craft a message with a malicious envelope address to achieve arbitrary command execution on Windows systems.
Why it matters: Developers using Email::Sender::Transport::Sendmail on Windows should upgrade to version 2.602 or later immediately, as this vulnerability allows remote code execution through crafted email messages.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-93012: Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe
CVE-2026-93012 affects Email::Sender::Transport::Sendmail, a Perl module for sending email. Versions before 2.602 allow arbitrary command execution on Windows when an envelope address is passed unsanitized to the shell in the _sendmail_pipe function.
Why it matters: Windows users running Perl applications with Email-Sender before 2.602 should upgrade immediately, as attackers can execute arbitrary commands by crafting malicious email addresses in message envelopes.
- Source published
- First seen by Cybersecurity Tracker