Net::IMAP, a Ruby library for IMAP client functionality, accepted ID and enable command arguments without rejecting CRLF sequences before version 0.6.5 and 0.5.15. The affected arguments were quoted correctly but not validated against line breaks, allowing an attacker to insert carriage‑return line‑feed characters that cause the IMAP server to parse an injected command. This vulnerability can enable an attacker to execute arbitrary IMAP commands and, depending on the server configuration, could lead to unauthorized data access, modification, or denial of service. The CVSS score of 5.8 classifies the weakness as moderate severity, and the fix resolves the injection path entirely.

The defect applies to the ruby:net-imap library in all releases earlier than 0.6.5 and 0.5.15. The affected products are Ruby implementations of the Net::IMAP client; any system using the vulnerable library is exposed until the issue is patched.

The vulnerability carries a moderate CVSS score of 5.8 and is not listed in CISA’s KEV catalog, and an EPSS score is not available. The attack vector is inferred to be remote: an attacker who can control or supply the ID or enable arguments of a Net::IMAP client that connects to an IMAP server can inject malicious commands. While exploitation requires the client to send a crafted request to a server, the presence of CRLF in the payload is sufficient for the server to interpret and execute the injected commands. No public exploits have been reported, but the nature of the flaw makes it a realistic target in environments where trusted clients may be compromised or embedded in untrusted code.