# CVE-2025-15366: Python CPython command injection in imaplib

Source: https://junglewise.ai/threats/cve-2025-15366-python-cpython-command-injection-in-imaplib  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-20. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2025-15366 · Severity: info · CVSS 5.9 · Published 2026-01-20

A vulnerability in Python's standard IMAP library could allow an attacker to inject unauthorized commands into an email session. If an application uses this library to process user-provided input without proper validation, an attacker could potentially manipulate email data or perform unauthorized actions on a mail server. This issue primarily affects systems where users can influence the specific commands sent to an IMAP server.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2025-15366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-15366 being exploited in the wild.

**How severe is CVE-2025-15366?** Informational severity, with a CVSS score of 5.9, published 20 January 2026.

**Which products and versions are affected?** Python Software Foundation CPython < 3.15.0a6.

**Is there a fix for CVE-2025-15366?** A patch was published on 2026-01-20: Initial fix merged into CPython main branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-15366 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-15366?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the imaplib module of CPython. The module failed to properly neutralize control characters, specifically newlines (CR/LF), when processing user-supplied input for IMAP commands. An attacker with the ability to influence command arguments can inject additional, unintended IMAP commands into the protocol stream. The fix involves implementing a check that rejects commands containing NUL, CR, or LF characters. This vulnerability is tracked as CWE-77 (Command Injection).

## Affected products

- Python Software Foundation CPython < 3.15.0a6

## Timeline

- 2026-01-16: disclosed: Issue reported and initial PR created in CPython repository.
- 2026-01-20: patched: Initial fix merged into CPython main branch.
- 2026-01-20: advisory: Official security announcement via Python security-announce mailing list.

## References

- [https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45](https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45)
- [https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d](https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d)
- [https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a](https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a)
- [https://github.com/python/cpython/issues/143921](https://github.com/python/cpython/issues/143921)
- [https://github.com/python/cpython/pull/143922](https://github.com/python/cpython/pull/143922)
- [https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/](https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)