Net::IMAP, a Ruby library for IMAP client functionality, allowed callers to pass symbol arguments directly to IMAP commands before certain releases. Those symbols were concatenated into the command string without proper escaping, enabling an attacker to inject carriage‑return line‑feed (CRLF) sequences and additional IMAP commands. This flaw can lead to arbitrary IMAP command execution on the server side, potentially leaking data, altering mailbox contents, or performing privileged operations. The weakness is classified as command injection (CWE‑77) and involves improper neutralization of special elements in a command context (CWE‑93).

Versions of the ruby:net-imap package older than 0.4.24, 0.5.14, and 0.6.4 are affected. The library is distributed as a Ruby gem and used by applications that rely on IMAP client capabilities.

The CVSS score is 5.8, indicating moderate severity. Exploitation requires an attacker who can influence the data sent to the IMAP client, such as through an application that forwards user input to IMAP commands. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. If an attacker can supply untrusted symbol arguments, they could inject additional IMAP commands, potentially compromising data confidentiality or integrity on the server.