SB20261109146 - Anolis OS update for ruby

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109146

SB20261109146 - Anolis OS update for ruby

Published: November 9, 2026

Security Bulletin ID SB20261109146
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Command injection (CVE-ID: CVE-2026-42257)

CWE-ID: CWE-77 - Command injection

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to execute arbitrary IMAP commands through an application's authenticated connection to a mail server.

The vulnerability exists due to missing validation and escaping of raw arguments in net-imap commands when an application passes unvalidated, user-controlled input to affected methods. An unprivileged local attacker can insert CRLF sequences into these arguments to inject additional commands, such as deleting mailboxes, during normal application use.


2) Command injection (CVE-ID: CVE-2026-42258)

CWE-ID: CWE-77 - Command injection

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to inject IMAP commands and delete mailboxes when a user triggers a vulnerable application command.

The vulnerability exists due to missing validation of Symbol arguments in net-imap when applications pass user-controlled input as Symbols to IMAP commands. An unprivileged local attacker can include CRLF sequences in a Symbol to terminate the original command and append a mailbox deletion command.


Remediation

Install update from vendor's website.

References