CVE-2025-59937: pebcak go-mail Argument Injection

Vulnerability summary

CVE-2025-59937 is a critical (CVSS 9.1) Argument Injection vulnerability in pebcak go-mail. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-09-2025
   PublishedVulnerability first disclosed.
2. 30-09-2025
   Last modifiedVulnerability information updated.

Description

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.