Arbitrary SMTP commands via CRLF in addresses

Command injection in Cole Maclean aiosmtplib before 5.1.1 allows remote attackers to inject SMTP commands via crafted addresses. SMTP.mail(), rcpt(), vrfy(), and expn() pass sender and recipient strings to the SMTP control connection verbatim, and the lower-level execute_command path did not reject control characters before appending CRLF and writing the command. Exposure requires attacker-controlled envelope data to reach those methods directly or through sendmail() or send() without a Message object; successful injection can desynchronize the session, hang the aiosmtplib instance, or send an arbitrary message, while send_message() is not affected.