---
id: CVE-2026-93012
title: >-
  Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow
  arbitrary command execution on Windows sending a message whose envelope
  address reaches the shell in _sendmail_pipe.


  On MSWin32 the envelope sender and every recipi…
summary: >-
  Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow
  arbitrary command execution on Windows sending a message whose envelope
  address reaches the shell in _sendmail_pipe.


  On MSWin32 the envelope sender and every recipi…
severity: none
cwe:
  - CWE-78
product: Email-Sender
affected:
  - Email-Sender < 2.602
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T18:17:16.137'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93012'
references:
  - url: >-
      https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/RJBS/Email-Sender-2.602/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-21T17:49:53.181Z'
---

## Overview

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe.

On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header.

An attacker who controls one of those header addresses runs commands as the sending process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.