Command injection in net-imap - CVE-2026-47240

Vulnerability identifier: #VU162943

CSH Severity: Medium

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47240

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an unprivileged local attacker to inject arbitrary IMAP commands into an application's session and delete mailboxes.

The vulnerability exists due to net-imap accepting non-synchronizing literals in raw arguments without verifying server support. An unprivileged local attacker can supply input that an application passes unvalidated to affected arguments, causing servers lacking literal support that continue after malformed commands to execute embedded commands.

net-imap
Debian Linux
Anolis OS
openEuler
Fedora
rubygem-net-telnet
rubygem-rss
rubygem-xmlrpc
rubygem-abrt
rubygem-abrt-doc
rubygem-io-console
rubygem-mysql2-doc
rubygem-mysql2
rubygem-typeprof
rubygem-power_assert
rubygem-did_you_mean
rubygem-bigdecimal
rubygem-rbs
rubygem-pg
rubygem-pg-doc
rubygem-racc
rubygem-irb
rubygem-json
rubygem-openssl
rubygem-bundler
ruby-help
ruby-devel
ruby-debugsource
ruby-irb
ruby-debuginfo
ruby
rubygems-devel
rubygems
rubygem-psych
ruby-bundled-gems
rubygem-rexml
rubygem-test-unit
ruby-libs
ruby-default-gems
ruby-doc
rubygem-minitest
rubygem-rdoc
rubygem-rake
ruby3.3 (Debian package)

Install security update from vendor's website.

net-imap - addressed in versions 0.4.25, 0.5.15, 0.6.4.1
rubygem-net-telnet - update to 0.1.1-141
rubygem-rss - addressed in versions 0.2.9-149, 0.2.9-158, 0.2.9-159
rubygem-xmlrpc - update to 0.3.0-141
rubygem-rss - addressed in versions 0.3.1-8, 0.3.1-9
rubygem-abrt - update to 0.4.0-1
rubygem-abrt-doc - update to 0.4.0-1
rubygem-io-console - addressed in versions 0.4.6-141, 0.5.7-149, 0.6.0-158, 0.6.0-159
rubygem-mysql2-doc - update to 0.5.5-1
rubygem-mysql2 - update to 0.5.5-1
rubygem-io-console - addressed in versions 0.7.1-8, 0.7.1-9
rubygem-typeprof - addressed in versions 0.15.2-149, 0.21.3-158, 0.21.3-159
rubygem-typeprof - addressed in versions 0.21.9-8, 0.21.9-9
rubygem-power_assert - update to 1.1.1-141
rubygem-did_you_mean - addressed in versions 1.2.0-141, 1.5.0-149, 1.6.3-158, 1.6.3-159
rubygem-bigdecimal - addressed in versions 1.3.4-141, 3.0.0-149, 3.1.3-158, 3.1.3-159
rubygem-rbs - addressed in versions 1.4.0-149, 2.8.2-158, 2.8.2-159
rubygem-pg - update to 1.5.4-1
rubygem-pg-doc - update to 1.5.4-1
rubygem-racc - addressed in versions 1.7.3-8, 1.7.3-9
rubygem-irb - addressed in versions 1.13.1-8, 1.13.1-9
rubygem-power_assert - addressed in versions 2.0.3-8, 2.0.3-9
rubygem-json - addressed in versions 2.1.0-141, 2.5.1-149, 2.6.3-158, 2.6.3-159
rubygem-openssl - addressed in versions 2.1.2-141, 2.2.1-149, 3.1.0-158, 3.1.0-159
rubygem-bundler - update to 2.2.32-149
ruby-help - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-devel - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-debugsource - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-irb - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby-debuginfo - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
ruby - addressed in versions 2.5.8-141, 3.0.3-149, 3.2.2-158, 3.2.2-159
rubygem-bundler - addressed in versions 2.5.22-8, 2.5.22-9
rubygem-json - addressed in versions 2.7.2-8, 2.7.2-9
rubygems-devel - addressed in versions 2.7.6-141, 3.2.32-149, 3.4.10-158, 3.4.10-159
rubygems - addressed in versions 2.7.6-141, 3.2.32-149, 3.4.10-158, 3.4.10-159
rubygem-psych - addressed in versions 3.0.2-141, 3.3.2-149, 5.0.1-158, 5.0.1-159
rubygem-bigdecimal - addressed in versions 3.1.5-8, 3.1.5-9
ruby-bundled-gems - addressed in versions 3.2.2-158, 3.2.2-159
rubygem-rexml - addressed in versions 3.2.5-149, 3.2.5-158, 3.2.5-159
rubygem-test-unit - addressed in versions 3.2.7-141, 3.3.7-149, 3.5.7-158, 3.5.7-159
ruby - addressed in versions 3.3.9-9, 3.3.12-8
rubygem-rexml - addressed in versions 3.3.9-9, 3.4.4-8
ruby-bundled-gems - addressed in versions 3.3.9-9, 3.3.12-8
ruby-devel - addressed in versions 3.3.9-9, 3.3.12-8
ruby-libs - addressed in versions 3.3.9-9, 3.3.12-8
ruby-default-gems - addressed in versions 3.3.9-9, 3.3.12-8
ruby-doc - addressed in versions 3.3.9-9, 3.3.12-8
rubygem-rbs - addressed in versions 3.4.0-8, 3.4.0-9
rubygems-devel - addressed in versions 3.5.22-8, 3.5.22-9
rubygems - addressed in versions 3.5.22-8, 3.5.22-9
rubygem-test-unit - addressed in versions 3.6.1-8, 3.6.1-9
ruby - addressed in versions 4.0.6-36.fc44, 4.0.6-36.fc45
rubygem-psych - addressed in versions 5.1.2-8, 5.1.2-9
rubygem-minitest - addressed in versions 5.10.3-141, 5.14.2-149, 5.16.3-158, 5.16.3-159
rubygem-minitest - addressed in versions 5.20.0-8, 5.20.0-9
rubygem-rdoc - addressed in versions 6.0.1.1-141, 6.3.3-149, 6.5.0-158, 6.5.0-159
rubygem-rdoc - addressed in versions 6.6.3.1-8, 6.6.3.1-9
rubygem-rake - addressed in versions 12.3.0-141, 13.0.3-149, 13.0.6-158, 13.0.6-159
rubygem-rake - addressed in versions 13.1.0-8, 13.1.0-9
ruby3.3 (Debian package) - update to 3.3.13-0+deb13u1

• https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8

• Debian update for ruby3.3
• Fedora 45 update for ruby
• Fedora 44 update for ruby
• openEuler 20.03 LTS SP4 update for ruby
• openEuler 24.03 LTS SP4 update for ruby
• openEuler 22.03 LTS SP4 update for ruby
• openEuler 24.03 LTS SP1 update for ruby
• openEuler 24.03 LTS SP3 update for ruby
• Anolis OS update for ruby:3.3 module
• Anolis OS update for ruby
• Multiple vulnerabilities in net-imap