---
id: CVE-2026-93012
title: >-
  Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow
  arbitrary command execution on Windows sending a message whose envelope
  address reaches the shell in _sendmail_pipe.


  On MSWin32 the envelope sender and every recipi…
summary: >-
  Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow
  arbitrary command execution on Windows sending a message whose envelope
  address reaches the shell in _sendmail_pipe.


  On MSWin32 the envelope sender and every recipi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
product: Email-Sender
affected:
  - Email-Sender < 2.602
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:17:11.867'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93012'
references:
  - url: >-
      https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/RJBS/Email-Sender-2.602/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/21/8'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00604
epssPercentile: 0.48704
ingestedAt: '2026-09-21T17:49:53.181Z'
---

## Overview

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe.

On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header.

An attacker who controls one of those header addresses runs commands as the sending process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.