Threats affecting pkg:cpan/Email-Sender

Email::Sender::Transport::Sendmail versions before 2.602 for Perl contain an OS command injection vulnerability on Windows platforms. This occurs because envelope sender and recipient addresses are concatenated into a single command string passed to the shell, allowing an attacker controlling these headers to execute arbitrary commands as the sending process. Other platforms are not affected as they invoke sendmail directly without shell interpretation.