#986083 mutt: when mutt is run with the standard input not attached to a terminal and without an e-mail address as an argument, it sends a mail

Package:
mutt
Source:
mutt
Description:
text-based mailreader supporting MIME, GPG, PGP and threading
Submitter:
Vincent Lefevre
Date:
2022-06-13 07:45:12 UTC
Severity:
normal
Tags:
#986083#5
Date:
2021-03-29 11:39:17 UTC
From:
To:
When mutt is run with the standard input not attached to a terminal
and without an e-mail address as an argument, it sends a mail, while
the help text requires at least an address in argument (which makes
sense). For instance:

  echo foo | mutt

When there are no default recipients, one gets an error, but when
there are default recipients (via my_hdr), a mail is really sent,
with the contents of the standard input (in the example, "foo").

As sending a mail is not expected in this case, this might be a
security issue (even if the recipient addresses belong to the user).

#986083#10
Date:
2022-05-06 21:47:23 UTC
From:
To:
This was fixed upstream in commit 4e01ccdb
<https://gitlab.com/muttmua/mutt/-/commit/4e01ccdb15ca1941e9b91d5e5ca7cb827bfe0f6d>
which was included in Mutt 2.1.0.