An unauthenticated OS command injection vulnerability in Email::Sender::Transport::Sendmail allows remote attackers to execute arbitrary code on Windows environments.

This is an OS Command Injection flaw (CWE-78) occurring in the _sendmail_pipe function. On Windows systems, the library incorrectly passes unsanitized envelope addresses directly to the system shell, allowing an unauthenticated attacker to inject malicious commands by controlling email headers.

The ability to execute arbitrary OS commands on a server hosting email transport services represents a critical security failure. Successful exploitation provides an attacker with the same privileges as the application process, potentially leading to full system compromise, exfiltration of sensitive data, and complete loss of server integrity. With a CVSS score of 9.8, this vulnerability is categorized as critical and poses an immediate threat to any Windows-based Perl environment utilizing this library.

Immediate Action: Upgrade to Email::Sender version 2.602 or later immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual email header content or suspicious process creation events initiated by the Perl interpreter.

Compensating Controls: If an immediate update is not feasible, implement strict validation for all email addresses used in headers to ensure they do not contain shell metacharacters, though patching remains the only reliable defense.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a severe risk to Windows-based infrastructure due to the potential for unauthenticated remote code execution. Administrators must prioritize updating the Email::Sender package to version 2.602 or higher across all affected environments. Failure to address this flaw could allow attackers to gain full control over the host system.