CVE-2025-59937 is a critical (CVSS 9.1) argument injection in the Go library go-mail, versions 0.7.0 and below. Crafted sender or recipient addresses can misroute mail or smuggle ESMTP parameters. Upgrade to 0.7.1, and note the risk depends on accepting arbitrary addresses.
What's affected
From GitHub advisory GHSA-wpwj-69cm-q9c5, the Go module github.com/wneessen/go-mail before 0.7.1 is affected, and the fix shipped in v0.7.1 through pull request 496.
The advisory states a condition. Exploitation requires that your code accepts arbitrary mail addresses, for example from a web form. If you only use static addresses from configuration and none of them has a quoted local part, the advisory says you should not be affected.
How to check if you're exposed
Check the version in use:
go list -m github.com/wneessen/go-mail
go mod why github.com/wneessen/go-mail
Then look for code paths where a sender or recipient address comes from user input, such as a contact form, an invite feature or a password reset flow. Those are the places where the condition in the advisory is met.
What to do now
- Upgrade to github.com/wneessen/go-mail v0.7.1 or later and rebuild.
- Run go mod tidy and confirm the new version in go.sum.
- Find every place user supplied addresses reach the library.
- Validate addresses at the edge and reject quoted local parts you do not need.
- Review sent mail logs for messages that went to unexpected recipients.
Why it matters
The record maps this to CWE-88, argument injection. The advisory explains the cause: the library passed the raw address field of a parsed address to the SMTP commands, rather than using the standard library's String method, which handles quoting and escaping. Special characters in a quoted address could then be read by the server as extra parameters on the command.
The effect is wrong routing or ESMTP parameter smuggling, and the advisory says other SMTP commands could potentially be smuggled too. For an application that sends password resets or invoices, mail going to an unintended recipient is a data leak. This CVE is not on the CISA KEV list. It is also a reminder that mail addresses are a rich grammar, and treating them as plain strings is risky.
Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-59937?
go-mail v0.7.1.
We only email fixed addresses from config. Are we affected?
The advisory says that if only static addresses are used and none has a quoted local part, this should not affect you.
Sources
- GitHub advisory GHSA-wpwj-69cm-q9c5
- Fix pull request
- NVD record data
Last reviewed: 18 October 2026.
