---
id: CVE-2026-47240
aliases:
  - GHSA-8p34-64r3-mwg8
title: 'Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument'
summary: 'Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument'
severity: medium
cwe:
  - CWE-77
  - CWE-93
vendor: net-imap
product: net-imap
ecosystem: rubygems
affected:
  - 'net-imap >= 0.6.0, <= 0.6.4'
  - net-imap <= 0.5.14
patched:
  - net-imap 0.6.4.1
  - net-imap 0.5.15
published: '2026-06-09'
updated: '2026-07-06'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8p34-64r3-mwg8'
references:
  - url: 'https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8'
  - url: 'https://github.com/ruby/net-imap/releases/tag/v0.6.4.1'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47240'
  - url: >-
      https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-47240.yml
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-47240'
  - url: 'https://github.com/advisories/GHSA-8p34-64r3-mwg8'
tags:
  - ghsa
  - rubygems
epss: 0.00831
epssPercentile: 0.55781
ingestedAt: '2026-07-07T15:41:59.606Z'
---

## Overview

Several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection.  However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals.

### Details

Raw data arguments support embedded literal values, both synchronizing and non-synchronizing.  Non-synchronizing literals can only be safely sent when the server advertises any of the `LITERAL+`, `LITERAL-`, or `IMAP4rev2` capabilities.  But raw data arguments do not verify server support for non-synchronizing literals prior to sending.

Servers without support for non-synchronizing literals could handle them in several different ways:  If a server sees a `"}\r\n"` byte sequence but can't parse the literal bytesize, it _may_ cautiously decide to close the connection, blocking any command injection attacks.  However, a server without support for non-synchronizing literals may instead interpret the `"+}\r\n"` as the end of a malformed command line and respond with a tagged `BAD`.  In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed.

This affects the following commands' string arguments:
* `criteria` for `#search` and `#uid_search`
* `search_keys` for `#sort`, `#thread`, `#uid_sort`, and `#uid_thread`
* `attr` for `#fetch` and `#uid_fetch`

Prior to `net-imap` v0.6.4, v0.5.14, and v0.4.24, raw data arguments were not validated in _any_ way, so they were also vulnerable to this attack.  See CVE-2026-42257 (GHSA-hm49-wcqc-g2xg).

### Impact

Fortunately, `LITERAL-` is supported by most modern IMAP servers.  Even without support for non-synchronizing literals, cautious servers may handle invalid literal bytesize by closing the connection .  However, servers which handle a non-synchronizing literal just like any other malformed command will enable this vulnerability.

If a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.

### Mitigation

Update to a version of `net-imap` which validates server support for non-synchronizing literals before sending them.

If upgrading `net-imap` is not possible:
* Explicitly validate user-controlled inputs to prevent embedded non-synchronizing literals unless the server supports them.
* For a simpler, more cautious approach: all embedded literals can be unconditionally prohibited, by checking that string inputs do not contain any CR or LF bytes.
* Verify that the server advertises any of the `LITERAL+`, `LITERAL-`, or `IMAP4rev2` capabilities before using untrusted string inputs for the affected "raw data" arguments.

## Affected packages

- `net-imap >= 0.6.0, <= 0.6.4`
- `net-imap <= 0.5.14`

## Remediation

Upgrade to a patched release:

- `net-imap 0.6.4.1`
- `net-imap 0.5.15`