CVE-2025-59937

Katalog CVE

CVSS 9.1 · Critical EPSS 0,54%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada pebcak go-mail. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1

Rincian

Terbit di NVD

29 September 2025

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 44,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wneessen/go-mail/security/advisories/GHSA-wpwj-69cm-q9c5 advisory vendor
• https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479 patch
• https://github.com/wneessen/go-mail/pull/496 issue tracking · patch
• https://github.com/wneessen/go-mail/issues/495 exploit · issue tracking