CVE-2026-42258: net-imap Command Injection Vulnerability via Unvalidated Symbol Inputs
Summary
CVE-2026-42258: net-imap vulnerable to command Injection via unvalidated Symbol inputs. Affects net-imap across 3 version ranges.
< 0.4.24
>= 0.5.0, < 0.5.14
>= 0.6.0, < 0.6.4
Fixed in 0.4.24, 0.5.14 or 0.6.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Net::IMAP is a Ruby library that provides an interface for interacting with Internet Message Access Protocol (IMAP) servers. It allows developers to manage email messages, folders, and other related functionalities. The library is widely used in applications that require email handling capabilities. However, it has been found to be vulnerable to command injection attacks due to improper validation of Symbol inputs, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the way Symbol arguments are handled in Net::IMAP commands. Specifically, user-controlled input can be passed as a Symbol without validation, allowing attackers to inject CRLF sequences and append malicious IMAP commands. This could result in unauthorized actions, such as deleting mailboxes or accessing sensitive information. The lack of restrictions on valid flag inputs exacerbates the issue, as it permits arbitrary user input to be processed as IMAP commands.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.4.240.4.24gem install net-imap -v 0.4.24 -
>= 0.5.0, < 0.5.140.5.14gem install net-imap -v 0.5.14 -
>= 0.6.0, < 0.6.40.6.4gem install net-imap -v 0.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid passing user-controlled input as Symbols to Net::IMAP commands. Instead, restrict inputs to a predefined list of valid IMAP flags or use string inputs with proper validation. For example, you can hard-code valid flag arguments in your application code to prevent injection attacks.
Conclusion
The net-imap library is vulnerable to command injection due to unvalidated Symbol inputs, which can lead to severe security implications. It is crucial for developers to upgrade to the latest patched versions and implement proper input validation to safeguard their applications against potential attacks.
See every vulnerability recorded for net-imap →
FAQ
The vulnerability allows for command injection via unvalidated Symbol inputs in Net::IMAP, enabling attackers to execute arbitrary IMAP commands.
Affected versions include net-imap versions prior to 0.6.4, 0.5.14, and 0.4.24.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Upgrade to a patched version of net-imap and ensure that user inputs are validated before being processed as Symbols.
The CVSS score for this vulnerability is 5.8, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for net-imap.
