The asynchronous SMTP client library aiosmtplib before version 5.1.1 fails to sanitize caller-supplied email addresses in SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() methods, allowing embedded CR/LF characters. These characters enable injection of additional SMTP commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. This injection can disrupt normal SMTP communication, cause client hangs, or send arbitrary messages without requiring control over the SMTP server. The SMTP.sendmail() and SMTP.send() methods that do not use a Message object are affected, while SMTP.send_message() is not. The issue is resolved in version 5.1.1.

An attacker who can influence the envelope sender or recipient address can inject arbitrary SMTP commands, potentially causing the SMTP client to hang, desynchronize communication, or send unauthorized messages. This could disrupt email sending functionality and allow message spoofing or unauthorized email transmission. No known exploits in the wild have been reported.

Upgrade aiosmtplib to version 5.1.1 or later, where input validation rejects embedded CR and LF characters in sender and recipient addresses, preventing SMTP command injection. No additional mitigation is required once the upgrade is applied.