BIT-python-2025-15366: IMAP command injection in user-controlled commands

Published Jan 20, 2026

Updated

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Affected Software

1 affected component

Python Software Foundation Python imaplib

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Reject IMAP commands containing control characters, including newlines, before passing user-controlled commands to imaplib.

Event History

Jan 20, 2026

CVE Published

via OSV·09:40 PM

Data Sourced

via OSV·09:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Python's imaplib are exposed when they pass user-controlled values as IMAP commands. The issue depends on untrusted command input reaching the module.

What does an attacker need to exploit it?

An attacker needs to influence an IMAP command supplied to imaplib and include newline/control characters to inject additional commands. The provided severity vector indicates network reachability, low attack complexity, and high privileges required.

What can be done if an update cannot be applied immediately?

Reject or sanitize user-controlled IMAP command values that contain control characters, including newlines. Do not allow untrusted input to determine IMAP commands.

BIT-python-2025-15366: IMAP command injection in user-controlled commands

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

What can be done if an update cannot be applied immediately?