{"id":"CVE-2026-47240","aliases":["GHSA-8p34-64r3-mwg8"],"title":"Net::IMAP: Command Injection via non-synchronizing literal in \"raw\" argument","summary":"Net::IMAP: Command Injection via non-synchronizing literal in \"raw\" argument","severity":"medium","cwe":["CWE-77","CWE-93"],"vendor":"net-imap","product":"net-imap","ecosystem":"rubygems","affected":["net-imap >= 0.6.0, <= 0.6.4","net-imap <= 0.5.14"],"patched":["net-imap 0.6.4.1","net-imap 0.5.15"],"published":"2026-06-09","updated":"2026-07-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-8p34-64r3-mwg8","references":[{"url":"https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8"},{"url":"https://github.com/ruby/net-imap/releases/tag/v0.6.4.1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47240"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-47240.yml"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47240"},{"url":"https://github.com/advisories/GHSA-8p34-64r3-mwg8"}],"tags":["ghsa","rubygems"],"epss":0.00491,"epssPercentile":0.41267,"ingestedAt":"2026-07-07T15:41:59.606Z","slug":"CVE-2026-47240","body":"## Overview\n\nSeveral Net::IMAP commands accept a \"raw data\" argument that is sent verbatim after validation to prevent command injection.  However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals.\n\n### Details\n\nRaw data arguments support embedded literal values, both synchronizing and non-synchronizing.  Non-synchronizing literals can only be safely sent when the server advertises any of the `LITERAL+`, `LITERAL-`, or `IMAP4rev2` capabilities.  But raw data arguments do not verify server support for non-synchronizing literals prior to sending.\n\nServers without support for non-synchronizing literals could handle them in several different ways:  If a server sees a `\"}\\r\\n\"` byte sequence but can't parse the literal bytesize, it _may_ cautiously decide to close the connection, blocking any command injection attacks.  However, a server without support for non-synchronizing literals may instead interpret the `\"+}\\r\\n\"` as the end of a malformed command line and respond with a tagged `BAD`.  In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed.\n\nThis affects the following commands' string arguments:\n* `criteria` for `#search` and `#uid_search`\n* `search_keys` for `#sort`, `#thread`, `#uid_sort`, and `#uid_thread`\n* `attr` for `#fetch` and `#uid_fetch`\n\nPrior to `net-imap` v0.6.4, v0.5.14, and v0.4.24, raw data arguments were not validated in _any_ way, so they were also vulnerable to this attack.  See CVE-2026-42257 (GHSA-hm49-wcqc-g2xg).\n\n### Impact\n\nFortunately, `LITERAL-` is supported by most modern IMAP servers.  Even without support for non-synchronizing literals, cautious servers may handle invalid literal bytesize by closing the connection .  However, servers which handle a non-synchronizing literal just like any other malformed command will enable this vulnerability.\n\nIf a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.\n\n### Mitigation\n\nUpdate to a version of `net-imap` which validates server support for non-synchronizing literals before sending them.\n\nIf upgrading `net-imap` is not possible:\n* Explicitly validate user-controlled inputs to prevent embedded non-synchronizing literals unless the server supports them.\n* For a simpler, more cautious approach: all embedded literals can be unconditionally prohibited, by checking that string inputs do not contain any CR or LF bytes.\n* Verify that the server advertises any of the `LITERAL+`, `LITERAL-`, or `IMAP4rev2` capabilities before using untrusted string inputs for the affected \"raw data\" arguments.\n\n## Affected packages\n\n- `net-imap >= 0.6.0, <= 0.6.4`\n- `net-imap <= 0.5.14`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `net-imap 0.6.4.1`\n- `net-imap 0.5.15`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}