Executive brief
The net-imap library, a tool used by Ruby applications to communicate with email servers, is vulnerable to command injection. If an application uses this library to process user-provided search terms or email attributes without proper validation, an attacker could inject malicious commands. This could allow an attacker to perform unauthorized actions on a user's mailbox, such as deleting emails or modifying folder structures.
Technical details
The net-imap library contains a command injection vulnerability where several methods (including #search, #fetch, #store, and #setquota) treat certain string arguments as 'raw data'. This bypasses the library's standard IMAP 'astring' encoding and validation, allowing CRLF sequences to be passed directly to the socket. An attacker can exploit this by providing specially crafted input that includes CRLF sequences followed by arbitrary IMAP commands (e.g., DELETE). The vulnerability is rooted in the use of Net::IMAP::RawData for specific arguments without neutralization. Patches have been released in versions 0.6.4, 0.5.14, and 0.4.24 which implement validation for raw data and transition certain methods away from raw data handling.
Affected products
- Ruby net-imap >= 0.6.0, <= 0.6.3; >= 0.5.0, <= 0.5.13; <= 0.4.23
Timeline
- 2026-04-24: disclosed: Vulnerability reported to ruby/net-imap
- 2026-05-04: advisory: GitHub Advisory published
- 2026-05-09: other: NVD published date