5.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47242

CVE-2026-47242: Net::IMAP: Command Injection via ID command argument

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47242

CVE-2026-47242:

5.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net-imap	rubygems	>= 0.6.0, <= 0.6.4	0.6.4.1
net-imap	rubygems	<= 0.5.14	0.5.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Net::IMAP library's failure to properly sanitize user-provided input in the enable and id methods. In both cases, the input arguments were used to construct IMAP command strings without adequate validation, specifically for Carriage Return (CR) and Line Feed (LF) characters. This allows an attacker to perform command injection by embedding malicious IMAP commands within the arguments. The analysis of the provided patches confirms this. For the enable method, the patch adds validation to ensure each capability is a valid IMAP atom. For the id method, the patch modifies the underlying string quoting mechanism to validate against and prevent CRLF sequences. An engineer with this vulnerability should be aware that any code path that calls Net::IMAP#enable or Net::IMAP#id with untrusted data is a potential vector for exploitation.

Vulnerable functions

Net::IMAP.enable

lib/net/imap.rb

The `enable` function did not properly validate its arguments before using them to construct an IMAP command. An attacker could pass an array containing a malicious string with a CRLF sequence, which would then be concatenated into the command string sent to the server, allowing for the injection of arbitrary IMAP commands.

Net::IMAP.id

lib/net/imap.rb

The `id` function accepts a hash argument for client identification. The values of this hash were passed to the `send_quoted_string` helper function, which did not sanitize the input for CRLF sequences. This allowed an attacker to inject arbitrary IMAP commands by providing a crafted string as a value in the hash passed to the `id` method.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.