CVE-2026-42257

net-imap: Command Injection via "raw" arguments to multiple commands

View on CVE.org
Published May 9, 2026 CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Analysis

AI-generated

Technical impact

Net::IMAP exposes several commands that accept a raw string argument. If an attacker controls the content of that string, the library forwards it to an IMAP server unescaped, allowing the injection of carriage return line feed sequences that create additional IMAP commands. The flaw enables an attacker to inject arbitrary IMAP commands, potentially compromising the server’s confidentiality, integrity, or availability by executing unintended actions. The weakness is a classic command injection (CWE-77) and a CRLF injection (CWE-93).

Affected Systems

The affected product is the Ruby library Net::IMAP, with all versions prior to 0.4.24, 0.5.14, and 0.6.4 vulnerable. Any Ruby application that depends on these earlier releases and passes user input into raw IMAP commands is at risk. Updating the library to v0.4.24 or newer fixes the issue.

Risk and Exploitability

The CVSS score of 5.8 indicates a moderate severity impact. The EPSS score is unavailable, so the current exploitation probability is unknown, but the vulnerability is not cataloged in the CISA KEV list. The likely attack vector is remote, as an attacker can supply user-controlled input through any interface that ultimately reaches the Net::IMAP client. Exploitation requires that the application construct raw IMAP commands from the attacker’s input and send them to an IMAP server without further validation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Net::IMAP to version 0.4.24 or newer, which removes the raw argument handling flaw.
  • If an upgrade is not immediately possible, avoid using raw IMAP command arguments with untrusted input; instead, construct commands using the library’s typed interfaces or sanitize the input to eliminate CRLF sequences.
  • Implement application‑level checks to ensure that any data supplied to IMAP commands originates from trusted sources or has been properly escaped before being passed to the Net::IMAP client.

Generated by OpenCVE AI on May 9, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-hm49-wcqc-g2xg net-imap vulnerable to command Injection via "raw" arguments to multiple commands
Ubuntu USN Ubuntu USN USN-8431-1 Ruby vulnerabilities
Ubuntu USN Ubuntu USN USN-8478-1 Ruby vulnerabilities
History
Type Values Removed Values Added
First Time appeared Ruby-lang net\
CPEs cpe:2.3:a:ruby-lang:net\:\:imap:*:*:*:*:*:ruby:*:*
Vendors & Products Ruby-lang net\
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'}

threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Ruby-lang
Ruby-lang net::imap
Vendors & Products Ruby-lang
Ruby-lang net::imap
Type Values Removed Values Added
Description Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Title net-imap: Command Injection via "raw" arguments to multiple commands
Weaknesses CWE-77
CWE-93
References
Metrics cvssV4_0

{'score': 5.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-93

    Improper Neutralization of CRLF Sequences ('CRLF Injection')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
May 13, 2026, 7:33 PM
Reserved
Apr 26, 2026, 11:53 AM

View source JSON

Updated
May 13, 2026, 7:33 PM

JSON

Status
Analyzed
Published
May 9, 2026, 8:16 PM
Modified
Jul 24, 2026, 9:10 PM

View source JSON

Severity
Moderate
Public date
May 9, 2026, 7:39 PM

View source Bugzilla JSON

Updated
May 10, 2026, 8:00 PM

JSON