{ "affected": [ { "database_specific": { "last_known_affected_version_range": "<= 0.6.4", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8p34-64r3-mwg8/GHSA-8p34-64r3-mwg8.json" }, "package": { "ecosystem": "RubyGems", "name": "net-imap", "purl": "pkg:gem/net-imap" }, "ranges": [ { "events": [ { "introduced": "0.6.0" }, { "fixed": "0.6.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "0.6.0", "0.6.1", "0.6.2", "0.6.3", "0.6.4" ] }, { "database_specific": { "last_known_affected_version_range": "<= 0.5.14", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8p34-64r3-mwg8/GHSA-8p34-64r3-mwg8.json" }, "package": { "ecosystem": "RubyGems", "name": "net-imap", "purl": "pkg:gem/net-imap" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.5.15" } ], "type": "ECOSYSTEM" } ], "versions": [ "0.1.0", "0.1.1", "0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.3.0", "0.3.1", "0.3.10", "0.3.2", "0.3.3", "0.3.4", "0.3.4.1", "0.3.5", "0.3.6", "0.3.7", "0.3.8", "0.3.9", "0.4.0", "0.4.1", "0.4.10", "0.4.11", "0.4.12", "0.4.13", "0.4.14", "0.4.15", "0.4.16", "0.4.17", "0.4.18", "0.4.19", "0.4.2", "0.4.20", "0.4.21", "0.4.22", "0.4.23", "0.4.24", "0.4.25", "0.4.3", "0.4.4", "0.4.5", "0.4.6", "0.4.7", "0.4.8", "0.4.9", "0.4.9.1", "0.5.0", "0.5.1", "0.5.10", "0.5.11", "0.5.12", "0.5.13", "0.5.14", "0.5.2", "0.5.3", "0.5.4", "0.5.5", "0.5.6", "0.5.7", "0.5.8", "0.5.9" ] } ], "aliases": [ "CVE-2026-47240" ], "database_specific": { "cwe_ids": [ "CWE-77", "CWE-93" ], "github_reviewed": true, "github_reviewed_at": "2026-06-09T18:36:04Z", "nvd_published_at": "2026-06-22T21:16:24Z", "severity": "MODERATE" }, "details": "Several Net::IMAP commands accept a \"raw data\" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals.\n\n### Details\n\nRaw data arguments support embedded literal values, both synchronizing and non-synchronizing. Non-synchronizing literals can only be safely sent when the server advertises any of the `LITERAL+`, `LITERAL-`, or `IMAP4rev2` capabilities. But raw data arguments do not verify server support for non-synchronizing literals prior to sending.\n\nServers without support for non-synchronizing literals could handle them in several different ways: If a server sees a `\"}\\r\\n\"` byte sequence but can't parse the literal bytesize, it _may_ cautiously decide to close the connection, blocking any command injection attacks. However, a server without support for non-synchronizing literals may instead interpret the `\"+}\\r\\n\"` as the end of a malformed command line and respond with a tagged `BAD`. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed.\n\nThis affects the following commands' string arguments:\n* `criteria` for `#search` and `#uid_search`\n* `search_keys` for `#sort`, `#thread`, `#uid_sort`, and `#uid_thread`\n* `attr` for `#fetch` and `#uid_fetch`\n\nPrior to `net-imap` v0.6.4, v0.5.14, and v0.4.24, raw data arguments were not validated in _any_ way, so they were also vulnerable to this attack. See CVE-2026-42257 (GHSA-hm49-wcqc-g2xg).\n\n### Impact\n\nFortunately, `LITERAL-` is supported by most modern IMAP servers. Even without support for non-synchronizing literals, cautious servers may handle invalid literal bytesize by closing the connection . However, servers which handle a non-synchronizing literal just like any other malformed command will enable this vulnerability.\n\nIf a developer passes an unvalidated user-controlled input for one of these method arguments, an attacker can append CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.\n\n### Mitigation\n\nUpdate to a version of `net-imap` which validates server support for non-synchronizing literals before sending them.\n\nIf upgrading `net-imap` is not possible:\n* Explicitly validate user-controlled inputs to prevent embedded non-synchronizing literals unless the server supports them.\n* For a simpler, more cautious approach: all embedded literals can be unconditionally prohibited, by checking that string inputs do not contain any CR or LF bytes.\n* Verify that the server advertises any of the `LITERAL+`, `LITERAL-`, or `IMAP4rev2` capabilities before using untrusted string inputs for the affected \"raw data\" arguments.", "id": "GHSA-8p34-64r3-mwg8", "modified": "2026-09-10T03:51:08.225147750Z", "published": "2026-06-09T18:36:04Z", "references": [ { "type": "WEB", "url": "https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47240" }, { "type": "PACKAGE", "url": "https://github.com/ruby/net-imap" }, { "type": "WEB", "url": "https://github.com/ruby/net-imap/releases/tag/v0.6.4.1" }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2026-47240.yml" }, { "type": "WEB", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47240" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Net::IMAP: Command Injection via non-synchronizing literal in \"raw\" argument" }