CVE-2026-47240: Net::IMAP Command Injection via Non-Synchronizing Literal
Summary
CVE-2026-47240: Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument. Affects net-imap across 2 version ranges.
< 0.5.15
>= 0.6.0, < 0.6.4.1
Fixed in 0.5.15 or 0.6.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Net::IMAP is a Ruby library that provides an interface for interacting with Internet Message Access Protocol (IMAP) servers. It allows developers to manage email messages, folders, and perform various operations on mailboxes. This library is widely used in applications that require email functionalities. However, it has a vulnerability that can lead to command injection attacks if user inputs are not properly validated.
Vulnerability Detail
The vulnerability arises from the way Net::IMAP handles raw data arguments in certain commands. Specifically, if a server does not support non-synchronizing literals, an attacker can inject arbitrary IMAP commands by manipulating the input. This can occur when user-controlled input is passed to methods like #search, #sort, and #fetch without proper validation. The lack of checks for server capabilities allows attackers to exploit this flaw, potentially leading to unauthorized actions such as deleting mailboxes.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.5.150.5.15gem install net-imap -v 0.5.15 -
>= 0.6.0, < 0.6.4.10.6.4.1gem install net-imap -v 0.6.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not feasible, you can implement the following workaround: Explicitly validate user-controlled inputs to prevent embedded non-synchronizing literals unless the server supports them. For a more cautious approach, ensure that string inputs do not contain any CR or LF bytes. Here is a sample code snippet to validate inputs:
def validate_input(input)
raise 'Invalid input' if input.include?('\r') || input.include?('\n')
input
end
Conclusion
In summary, CVE-2026-47240 is a significant vulnerability in the Net::IMAP library that can lead to command injection if user inputs are not properly validated. It is crucial to update to the patched version or implement workarounds to mitigate the risk.
See every vulnerability recorded for net-imap →
FAQ
CVE-2026-47240 is a vulnerability in the Net::IMAP library that allows for command injection via non-synchronizing literals in raw data arguments.
An attacker can exploit this vulnerability by injecting arbitrary IMAP commands through unvalidated user inputs, potentially leading to unauthorized actions.
Versions of net-imap prior to 0.6.4.1 and 0.5.15 are affected by this vulnerability.
If upgrading is not possible, ensure to validate user inputs to prevent command injection and avoid using non-synchronizing literals.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for net-imap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
