CyberRota Analysis
AI-GeneratedNodemailer versions prior to 8.0.5 are vulnerable to an SMTP command injection due to unsanitized input in the transport name option for EHLO/HELO commands. This flaw allows attackers to inject arbitrary SMTP commands, potentially enabling email spoofing and phishing attacks. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.