CVE-2025-7962

What it actually does

The vulnerability permits SMTP command injection through the use of carriage return (\r) and line feed (\n) characters in email message handling within Jakarta Mail prior to 2.0.2, allowing separation of multiple messages and injection of arbitrary SMTP commands.

Why it matters to the business

Attackers could send unauthorized emails from affected systems, enabling spam, phishing, or data exfiltration that increases operational costs, damages reputation, and creates compliance exposure, with urgency driven by the 462 days since publication and rising EPSS trend.

How an attack unfolds

An attacker supplies specially crafted input containing embedded \r\n sequences to the Grafana Infinity Datasource, which passes it to the vulnerable Jakarta Mail library, allowing injection of additional SMTP commands to manipulate or send extra email messages without authentication.

How to fix it

Upgrade grafana/grafana-infinity-datasource to commit 9c736aa21b3a669d3070d3f5f80d949326fafa77 or later, which incorporates Jakarta Mail 2.0.2 or higher to sanitize line terminators.

How to confirm the fix worked

Confirm the installed commit hash matches 9c736aa21b3a669d3070d3f5f80d949326fafa77, then retest email processing paths with CRLF payloads to ensure commands are no longer injectable.

Typical attack path

1. Identify an input vector or configuration option in the Grafana Infinity Datasource that processes email data
2. Craft malicious payload embedding SMTP commands separated by \r and \n UTF-8 characters
3. Trigger the email sending or processing functionality
4. Verify successful injection by observing delivery of unauthorized messages or SMTP responses

How to detect it

Review application and email server logs for sequences of multiple SMTP commands within single sessions or unexpected carriage-return/line-feed patterns in message content; correlate with datasource email activity timestamps.

What your security team should do

• Prioritize upgrade of the Grafana Infinity Datasource to the fixed commit within the next patch cycle
• Temporarily disable or restrict email notification features if upgrade cannot be immediate
• Audit email logs for anomalous volume or content since publication date