External risk intelligence

Email::Sender::Transport::Sendmail Command Execution on Windows

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-93012

This is a library used by developers to facilitate email sending. While the library itself is not a public-facing service, it may be integrated into applications that process user-supplied email headers, such as web forms or mail submission services, which could plausibly be exposed to the internet depending on the implementation.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a Perl email sending library could allow an attacker to execute commands on Windows systems by sending specially crafted email messages. This could have significant implications if the affected library is used in applications that process external email addresses.

Code vulnerability allows remote command execution.
Affects applications sending or processing emails.
Confirm library usage and exposure to untrusted input.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by sending a specially crafted email where the envelope sender or recipient addresses contain shell metacharacters. If the email is processed by a vulnerable version of Email::Sender::Transport::Sendmail on Windows, these addresses can be interpreted as commands by the operating system's shell, leading to arbitrary command execution.

Requires control of email addresses.
Triggers via malformed envelope addresses.
Allows arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands on Windows systems when a specially crafted email message is sent. The issue arises because certain email header addresses are passed directly to the system's shell, enabling command injection. This could affect any application using the affected software to send emails on Windows.

Arbitrary command execution on Windows.
An attacker sends a crafted email message.
System compromise when sending emails.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Perl applications using Email::Sender::Transport::Sendmail on Windows, allowing unauthenticated attackers to execute arbitrary commands by sending specially crafted email messages. Application owners and platform teams are likely responsible for identifying and mitigating this risk. The first practical step is to locate all instances of the affected library, assess their exposure and criticality, and then plan remediation, which may involve coordinating with vendors or applying code changes.

Application owners should own the issue.
Verify if Windows systems are impacted.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Email::Sender::Transport::Sendmail?

It is a Perl software library designed to help developers build applications that send emails. It acts as a bridge between a Perl program and the underlying mail transfer agent. You will typically find it integrated into custom scripts or systems that need to automate email delivery, such as contact forms, automated notifications, or newsletter systems.

What does CVE-2026-93012 mean?

This vulnerability is classified as CWE-78, or Improper Neutralization of Special Elements used in an OS Command. In plain English, the software fails to properly scrub input data before passing it to the computer's command shell. Because of how it behaves on Windows, specific email addresses provided to the library can be misinterpreted as system instructions, allowing an unauthorized person to run arbitrary commands on the host server.

How does an attacker trigger this command injection?

The issue occurs when the library handles email addresses containing shell metacharacters on a Windows system. The library takes these addresses—often from To, Cc, or From headers—and incorrectly passes them to the operating system's shell. This does not trigger if the application runs on non-Windows platforms, which use a safer list-based method to handle delivery, or if the library is never provided with untrusted or externally influenced email addresses.

How do I know if I am affected?

According to Halo Surface Signal, the risk depends on your specific implementation. While this is a code library rather than a standalone service, any application using an affected version on Windows that processes user-supplied email headers is at risk. You should be concerned if your software takes email inputs from web forms or external sources and passes them to this library for processing on a Windows host.

What steps should I take if I use this library?

Start by identifying all applications in your environment that rely on this Perl library and confirm which ones are hosted on Windows. Once mapped, prioritize those that process email addresses provided by external users. Your primary goal is to determine if these applications are exposed to untrusted input. Coordinate with your development team to verify the library version and plan for necessary code updates to sanitize input or upgrade the component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.