What is the CVSS score of EUVD-2026-38353?

EUVD-2026-38353 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-38353?

Yes, a patch is available for EUVD-2026-38353. Update the affected software to the latest version immediately.

Ruby net-imap EUVD-2026-38353

| CVE-2026-47242 MEDIUM

Command Injection (CWE-77)

2026-06-09 https://github.com/ruby/net-imap

GHSA-46q3-7gv7-qmgg

Command Injection

5.8

CVSS 4.0 · Vendor: https://github.com/ruby/net-imap

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker supplies CRLF-embedded string to application
Delivery

Application passes untrusted value to Net::IMAP#id or #enable
Exploit

Library serializes value without CRLF validation
Execution

Injected IMAP command appended to protocol stream
Persist

IMAP server processes injected command in authenticated session
Impact

Server-side action executed (e.g., mailbox deletion or manipulation)

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a Ruby application on a vulnerable net-imap version (0.6.0-0.6.4 or ≤0.5.14) that passes attacker-controlled data as arguments to Net::IMAP#id (as hash values) or Net::IMAP#enable. For #id, the attacker-controlled value must include a CRLF byte sequence (0x0D 0x0A) to terminate the current command and begin a new one. For #enable, any .to_s output that is not a valid IMAP atom (including strings with spaces, CRLF, or special characters) can produce malformed protocol output. The limiting factor is the rarity of passing dynamic, untrusted input to either command: ID field values are most commonly hardcoded strings (library names, version numbers), and #enable arguments are drawn from a fixed set of IMAP capability names. Authentication requirements cannot be confirmed from available data because no CVSS vector is provided; however, the injected commands execute within the context of an already-authenticated IMAP session, meaning the session itself must be established before injection is possible.
Impact	No CVSS vector or score was provided by NVD or the vendor advisory, so quantitative severity metrics (attack vector, complexity, privilege requirements) cannot be confirmed from available data. The maintainer rates the vulnerability as 'moderate' severity in the v0.6.4.1 release notes. EPSS data is absent. There is no CISA KEV listing and no public exploit code identified at time of analysis. Real-world risk is materially reduced by the precondition that an application must actively pass untrusted user-controlled input to Net::IMAP#id or Net::IMAP#enable - the advisory explicitly states this pattern is uncommon, and #enable documentation already warns against non-enumerated arguments. The injected commands affect whatever IMAP session the gem controls, so impact is bounded to that mailbox session. Lateral movement or data exfiltration is indirect and depends on server configuration (e.g., shared folders, server-side scripts). Overall, this is a narrow-surface injection vulnerability with real but limited blast radius rather than a broadly exploitable network-level flaw.
Exploit ScenarioDerived	An attacker with the ability to influence configuration values or version strings that a Ruby application passes to Net::IMAP#id - for example, a user-supplied 'client name' field in a multi-tenant mail application - submits a value containing a CRLF sequence followed by a complete IMAP command such as 'A002 DELETE INBOX'. The net-imap library quotes the surrounding string but transmits the CRLF literally, causing the IMAP server to process the injected command within the established authenticated session. No public exploit code has been identified, and exploitation is constrained to contexts where untrusted data reaches these specific API calls.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 09, 2026

Command injection in Ruby's net-imap gem allows arbitrary IMAP protocol command injection via the Net::IMAP#id and Net::IMAP#enable methods when untrusted input is passed as arguments. The #id method fails to prohibit CRLF sequences in ID field value strings (despite correctly quoting other specials), while #enable passes argument .to_s values verbatim without validating them as legal IMAP atoms. An attacker who can influence these inputs can terminate the current IMAP command and append arbitrary subsequent IMAP commands such as DELETE mailbox. Rated 'moderate' by the maintainer; no public exploit identified at time of analysis and no CISA KEV listing.

RemediationAI

The primary fix is to upgrade net-imap to version 0.6.4.1 (for applications on the 0.6.x branch) or version 0.5.15 (for applications on the 0.5.x branch), as confirmed by the vendor advisory GHSA-46q3-7gv7-qmgg and the release at https://github.com/ruby/net-imap/releases/tag/v0.6.4.1. The fixes add validation that ID field values contain only permitted bytes (PRs #698 and #699) and that #enable arguments conform to the IMAP atom grammar. If upgrading is not immediately possible, the maintainer recommends two compensating controls: first, eliminate any use of untrusted user input as arguments to Net::IMAP#enable entirely - the documentation already designates this a misuse; second, for Net::IMAP#id, add application-level input validation that rejects any ID field value containing CR (0x0D) or LF (0x0A) bytes before passing them to the library. The trade-off of the second control is that it must be applied consistently at every call site; missing a single call site leaves the injection path open.

Affected VersionsENISA

net-imap < 0.5.15

net-imap 0.6.0, < 0.6.4.1

Affected Packages

rubygems net-imap fix: 0.5.15, 0.6.4.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Net::IMAP is Ruby's standard library client for the Internet Message Access Protocol (RFC 3501), shipped as a standalone RubyGems package (pkg:rubygems/net-imap). The #id method implements the IMAP ID extension (RFC 2971), exchanging client/server identification metadata. The #enable method implements RFC 5161, activating optional IMAP capabilities. Both commands construct raw IMAP protocol strings sent over a TCP/TLS socket. The root cause (CWE-77 - Command Injection) is insufficient input neutralization: #id escapes quoted-string specials but omits CRLF validation, and #enable serializes arguments via .to_s without verifying they conform to the IMAP 'atom' token grammar. Because IMAP uses CRLF as a command terminator, an unvalidated CRLF sequence in either command's wire output allows a second, attacker-controlled command to be injected into the protocol stream.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/ruby/net-imap) PRIMARY 5.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE 6.8 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Red Hat 7.3 HIGH

Primary rating from Vendor (https://github.com/ruby/net-imap).

CVSS VectorVendor: https://github.com/ruby/net-imap

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

High

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Jun 22, 2026 - 21:39 NVD

5.8 (MEDIUM)

DescriptionCVE.org

Summary

Two Net::IMAP commands, #id and #enable, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.

Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.

Details

When Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.

While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim.

Impact

This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.

The documentation for #enable explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for #enable will always be inappropriate.

Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.

Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.

Mitigation

Update to a version of net-imap which validates #id and #enable arguments.

Untrusted inputs should _never_ be used for #enable arguments.

If net-imap cannot be upgraded:

do not use untrusted inputs for client ID field values
or add validation that client ID field values must not contain any CR or LF bytes.

Threat Intelligence Overview

EPSS Score

0.0%

Top 94% exploitable

Threat Intel

1 sources

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +29

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Same weakness CWE-77 – Command Injection

View all

CVE-2024-21887 CRITICAL POC

9.1

CVE-2016-3081 HIGH POC

8.1

CVE-2012-1823 CRITICAL POC

9.8

CVE-2016-1555 CRITICAL POC

9.8

CVE-2024-55956 CRITICAL POC

9.8

CVE-2015-2051 HIGH POC

8.8

CVE-2017-6327 HIGH POC

8.8

CVE-2023-34960 CRITICAL POC

9.8

Same technique Command Injection

View all

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back