---
id: CVE-2025-15366
title: >-
  The imaplib module, when passed a user-controlled command, can have additional
  commands injected using newlines
summary: >-
  The imaplib module, when passed a user-controlled command, can have additional
  commands injected using newlines. Mitigation rejects commands containing
  control characters.
severity: none
cwe:
  - CWE-77
published: '2026-01-20'
updated: '2026-07-07'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15366'
references:
  - url: >-
      https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/143921'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/143922'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/
    label: cna@python.org
tags:
  - nvd
epss: 0.00422
epssPercentile: 0.3613
ingestedAt: '2026-07-07T18:42:24.186Z'
---

## Overview

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.