CVE-2011-0739: Mikel Lindsaar Mail

Medium severity, CVSS 6.8. EPSS: 2.7% chance of exploitation in the next 30 days.

The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.

Affected products

• Mikel Lindsaar Mail: up to and including 2.2.14; version 1.0.0 only; version 1.1.0 only; version 1.2.1 only; version 1.2.5 only; version 1.2.6 only; …

Published 2011-02-02. Last modified 2026-06-16.