BIT-python-2025-15367: POP3 command injection in user-controlled commands

Published Jan 20, 2026

Updated

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Affected Software

1 affected component

Python Software Foundation Python poplib

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Reject user-controlled POP3 commands containing newlines or other control characters to prevent additional commands from being injected.

Event History

Jan 20, 2026

CVE Published

via OSV·09:47 PM

Data Sourced

via OSV·09:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An application must pass attacker-controlled input as a POP3 command through the poplib module. The attacker needs a way to include newline or other control characters in that command input so that additional POP3 commands can be injected.

Who is most likely exposed?

Applications that use Python poplib and construct or forward POP3 commands from untrusted input are exposed. The provided data does not establish that applications using only fixed, application-defined commands are affected.

What mitigation is identified?

Reject user-controlled commands containing control characters. This prevents newline-based injection of additional POP3 commands.

BIT-python-2025-15367: POP3 command injection in user-controlled commands

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Who is most likely exposed?

What mitigation is identified?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Who is most likely exposed?

What mitigation is identified?