Command Injection in net-imap (CVE-2026-47240)
Summary
Command injection in net-imap (CVE-2026-47240). Risk of unauthorized operations or information disclosure. Exploitable via IMAP4rev2. Mitigation: upgrade to 0.5.15 or later.
Original description
The description as published by the source.
Several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals.
Details
Raw data arguments support embedded literal values, both synchronizing and non-synchronizing. Non-synchronizing literals can only be safely sent when the server advertises any of the LITERAL+, LITERAL-, or IMAP4rev2 capabilities. But raw data arguments do not verify server support for non-synchronizing literals prior to sending.
Servers without support for non-synchronizing literals could handle them in several different ways: If a server sees a "}\r\n" byte sequence but can't parse the literal bytesize, it may cautiously decide to close the connection, blocking any command injection attacks. However, a server without support for non-synchronizing literals may instead interpret the "+}\r\n" as the end of a malformed command line and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed.
This affects the following commands' string arguments:
criteriafor#searchand#uid_searchsearch_keysfor#sort,#thread,#uid_sort, and#uid_threadattrfor#fetchand#uid_fetch
Prior to net-imap v0.6.4, v0.5.14, and v0.…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-47240 has been found in net-imap.
Attackers can target a specific entry point like IMAP4rev2 over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade net-imap to 0.5.15 or later.
If unsure, ask your IT team or search "net-imap CVE-2026-47240" on the vendor's site.
CVE-2026-47240 (net-imap) — CWE-77
Attack surface: IMAP4rev2 / BAD / criteria / search_keys
Patched: 0.5.15 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-77) exists in net-imap. Attackers reach the vulnerable code path via IMAP4rev2.
Check the vendor advisory for the affected versions of net-imap. Attack surface: IMAP4rev2 / BAD / criteria / search_keys.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 0.5.15.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'net-imap' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'net-imap' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
net-imapを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade net-imap to 0.5.15ステージング環境で 0.5.15 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2026-47240 ruby-net-imap Fixed in: 0.5.15-r0
- Ubuntu UBUNTU-CVE-2026-47240 jruby
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web cve.org