net-imap CVE-2026-42257
MEDIUM
GHSA-hm49-wcqc-g2xg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker identifies vulnerable application using net-imap
-
Deliverysupplies malicious input containing CRLF to search/fetch/store method
-
Exploitlibrary sends raw string with unescaped CRLF to server
-
ExecutionCRLF breaks command context
-
Persistinjected IMAP command executes on server
-
Impactattacker achieves state modification (DELETE, COPY, STORE) or information disclosure via chained commands
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a Ruby application use net-imap and pass user-controlled input to at least one of the following method arguments without validation: string criteria to #search or #uid_search; string attr or array containing strings to #fetch or #uid_fetch; string attr to #store or #uid_store; or unsanitized input to #setquota's limit argument. The IMAP server must accept and process the injected command; most standard IMAP servers will execute DELETE, STORE, COPY, and other commands if properly formed. No special server configuration is required. The attack is limited by the attacker's knowledge of the target mailbox structure and the permissions of the account the application uses to connect to the IMAP server. For #setquota, exploitation is further limited by the expectation that this method is used only by trusted administrators with SETQUOTA privilege on the server; widespread exploitation of this specific method is unlikely unless combined with CSRF or privilege escalation attacks. |
| Impact | This vulnerability presents substantial real-world risk despite the absence of a CVSS score. The attack vector is network-based (applications connect to IMAP servers over the network), attack complexity is low (simple CRLF injection), and no authentication is required from the attacker's perspective-only that a vulnerable application passes unvalidated input to one of the affected methods. The library itself is widely used in Ruby applications, particularly mail clients, archival tools, and email processing systems that commonly construct search queries or fetch attributes dynamically. The Common Weakness Enumeration (CWE-77) classification confirms command injection as the root cause. The vulnerability is not a zero-day or theoretical: GitHub commit evidence shows patches have been merged into multiple version branches (0.4.x, 0.5.x, 0.6.x), indicating the Ruby maintainers have validated and addressed the issue. The impact is significant because the most commonly used methods (#search, #fetch, #store) are affected, and the CVE description explicitly notes that applications building queries from user input face 'significant risk.' However, practical exploitation requires two conditions: (1) a vulnerable application must pass unsanitized user input to one of these methods, and (2) the attacker must have knowledge of the target system to craft meaningful IMAP commands (e.g., knowing mailbox names for DELETE). This makes widespread automated exploitation less likely than targeted exploitation against known systems or vulnerable applications. |
| Exploit ScenarioDerived | A Ruby mail client or email archival application allows users to enter custom search criteria through a web form or API. The application constructs a search query by concatenating user input directly into a string passed to imap.search(criteria_string). An attacker enters the value 'BODY test\r\nDELETE INBOX' in the search field. The CRLF injection breaks the SEARCH command context and injects a DELETE INBOX command, which executes on the server and deletes the user's inbox. No POC code is explicitly referenced in the input data, but the attack is straightforward given the direct injection vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 04, 2026
Command injection in net-imap library allows attackers to inject arbitrary IMAP commands by supplying unvalidated user input to multiple methods that send raw, unescaped strings to the IMAP server. The #search, #uid_search, #fetch, #uid_fetch, #store, #uid_store, and #setquota methods accept string arguments that bypass normal validation and encoding, enabling CRLF injection to break command context. Applications that dynamically construct search criteria, fetch attributes, or quota limits from user input are at significant risk; a developer passing unsanitized input could allow an attacker to append malicious IMAP commands such as DELETE or other state-modifying operations.
RemediationAI
Vendor-released patches are available: upgrade to net-imap 0.6.4 (for 0.6.x users), 0.5.14 (for 0.5.x users), or 0.4.24 (for 0.4.x users) immediately, as these versions add RawData validation and remove RawData usage from #store, #uid_store, and #setquota methods. If immediate upgrade is not possible, implement the following mitigations from the vendor advisory: for search criteria and fetch attributes, pass an array of key-value pairs instead of interpolated strings; validate string inputs against CRLF characters by checking for '\r' and '\n' before passing to these methods; hard-code the attr argument to #store and #uid_store rather than deriving it from user input, or restrict user-controlled inputs to a whitelist of valid attribute names; use Kernel#Integer to coerce and validate user-controlled inputs to #setquota limit argument. See the GitHub advisory at https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg for detailed guidance on each method.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Net::IMAP is the Ruby standard library for IMAP protocol communication. Most command arguments are safely handled by generic argument processing that encodes strings as IMAP astring values (atom, quoted, or literal), which prevents injection. However, specific methods bypass this protection by converting string arguments to Net::IMAP::RawData objects, which send the string directly to the socket without validation or escaping. The vulnerability stems from CWE-77 (Improper Neutralization of Special Elements used in a Command), where CRLF characters (carriage return and line feed) in raw strings allow command splitting. The affected methods are search/uid_search (criteria argument), fetch/uid_fetch (attr argument as string or array of strings), store/uid_store (attr argument), and setquota (limit argument after string interpolation). The IMAP protocol uses CRLF as command delimiters, making unescaped CRLF sequences a direct injection vector.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: https://github.com/ruby/net-imap
Lifecycle Timeline
1DescriptionCVE.org
Summary
Several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.
Details
Net::IMAP's generic argument handling, used by most command arguments, interprets string arguments as an IMAP astring. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a atom, quoted, or literal. These are safe from command or argument injection.
But the following commands transform specific String arguments to Net::IMAP::RawData, which bypasses normal argument validation and encoding and prints the string directly to the socket:
#uid_search,#search- when
criteriais a String, it is sent raw #uid_fetch,#fetch- when
attris a String, it is sent raw - when
attris an Array, each String inattris sent raw #uid_store,#store- when
attris a String, it is sent raw #setquota:limitis interpolated with#to_sand that string is sent raw
Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.
Using "raw data" arguments for #uid_store, #store, and #setquota I both inappropriate and unnecessary. Net::IMAP's generic argument handling is sufficient to safely validate and encode their arguments. Users of the library probably do not expect arguments to these commands to be sent raw and might not be wary of passing unvalidated input.
The API for search criteria and fetch attributes is intentionally low-level and "close to the wire". It allows developers to use some IMAP extensions without requiring explicit support from the library and allows developers to use complex IMAP grammar without complex argument translation. Even so, basic validation is appropriate and could neutralize command injection.
Although this was explicitly documented for search criteria, it was insufficiently documented for fetch attr. So developers may not have realized that the attr argument to #fetch and #uid_fetch is sent as "raw data".
Impact
If a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not _directly_ enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.
The SEARCH, STORE, and FETCH commands, and their UID variants are some of the most commonly used features of the library. Applications that build search queries or fetch attributes dynamically based on user input (e.g., mail clients or archival tools) may be at significant risk.
Expected use of Net::IMAP#setquota is much more limited: SETQUOTA is often only usable by users with special administrative privileges. Depending on the server, quota administration might be managed through server configuration rather than via the IMAP protocol SETQUOTA command. It is expected to be uncommonly used in system administration scripts or in interactive sessions, it should be completely controlled by trusted users, and should only use trusted inputs. Calling #setquota with untrusted user input is expected to be a very uncommon use case. Please note however this might be combined with other attacks, for example CSRF, which provide unauthorized access to trusted inputs, and may specifically target users or scripts with administrator privileges.
Mitigation
- Update to a patched version of
net-imapwhich: - validates that
Net::IMAP::RawDatais composed of well-formed IMAPtext,literal, andliteral8values, with no unescapedNULL,CR, orLFbytes. - does not use
Net::IMAP::RawDatafor#store,#uid_store, or#setquota. - Prefer to send search criteria as an array of key value pairs. Avoid sending it as an interpolated string.
- If an immediate upgrade is not possible:
- String inputs to search criteria and fetch attributes can be validated against command injection by checking for
\rand\ncharacters. - Hard-coding the store
attrargument is often appropriate. Alternatively, user controlled inputs can be restricted to a small enumerated list which is valid for the calling application. - Use
Kernel#Integerto coerce and validate user controlled inputs to#setquotalimit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB