BIT-python-min-2025-15366: IMAP command injection in user-controlled commands
Published Jan 20, 2026
·Updated
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Affected Software
1 affected component
Python Software Foundation imaplib
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject user-controlled IMAP commands that contain control characters, including newlines, to prevent additional commands from being injected.
Event History
Jan 20, 2026
CVE Published
via OSV·09:40 PM
Data Sourced
via OSV·09:40 PM
DescriptionSeverityWeakness