CVE-2020-28247

Argument injection in lettre

5.3 MediumFix available

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.52%Up 0.7 points since Apr 14, 2021

What each source reports

NVD Score used 5.3

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

Record: CVE-2020-28247
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

Record: CVE-2020-28247
Updated: 2026-11-02

EUVDEUVD-2021-1888 No score

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

Record: EUVD-2021-1888
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vc2p-r46x-m3vx 5.3

Argument injection in lettre

Impact

Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.

Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into abritrary files (using sendmail's logging features).

NOTE: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.

Fix

The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.

References

Record: GHSA-vc2p-r46x-m3vx
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-77
Updated: 2026-11-02

OSV 5.3

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

Record: CVE-2020-28247
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-vc2p-r46x-m3vx 5.3

Argument injection in lettre

Impact

Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.

Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into abritrary files (using sendmail's logging features).

NOTE: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.

Fix

The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.

References

Record: GHSA-vc2p-r46x-m3vx
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-77
Updated: 2026-11-02

OSVRUSTSEC-2020-0069 5.3

Argument injection in sendmail transport

Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.

Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into arbitrary files (using sendmail's logging features).

The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.

NOTE: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.

This vulnerability was reported by vin01.

Record: RUSTSEC-2020-0069
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

lettre

Affected packages

Affected packages
Package	Affected	Fixed
`lettre` crates.io	0.9.0 up to 0.9.5	0.9.5
`lettre` crates.io	0.8.0 up to 0.8.4	0.8.4
`lettre` crates.io	0.7.0 up to 0.7.1	0.7.1
`lettre` crates.io	0.7.0 up to 0.7.1, 0.8.0 up to 0.8.4, 0.9.0 up to 0.9.5, 0.10.0-alpha.1 up to 0.10.0-alpha.4	0.7.10.8.40.9.50.10.0-alpha.4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-28247 is a medium vulnerability (CVSS 5.3) in Lettre, published November 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in lettre 0.9.5.