Net::IMAP exposes several commands that accept a raw string argument. If an attacker controls the content of that string, the library forwards it to an IMAP server unescaped, allowing the injection of carriage return line feed sequences that create additional IMAP commands. The flaw enables an attacker to inject arbitrary IMAP commands, potentially compromising the server’s confidentiality, integrity, or availability by executing unintended actions. The weakness is a classic command injection (CWE-77) and a CRLF injection (CWE-93).

The affected product is the Ruby library Net::IMAP, with all versions prior to 0.4.24, 0.5.14, and 0.6.4 vulnerable. Any Ruby application that depends on these earlier releases and passes user input into raw IMAP commands is at risk. Updating the library to v0.4.24 or newer fixes the issue.

The CVSS score of 5.8 indicates a moderate severity impact. The EPSS score is unavailable, so the current exploitation probability is unknown, but the vulnerability is not cataloged in the CISA KEV list. The likely attack vector is remote, as an attacker can supply user-controlled input through any interface that ultimately reaches the Net::IMAP client. Exploitation requires that the application construct raw IMAP commands from the attacker’s input and send them to an IMAP server without further validation.