CVE-2025-15366: IMAP command injection in user-controlled commands
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the IMAP command injection by rejecting any user-controlled IMAP commands that contain control characters (including newline characters used for command injection).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15366?
CVE-2025-15366 has a moderate severity level due to potential command injection vulnerabilities.
How do I fix CVE-2025-15366?
To fix CVE-2025-15366, ensure that commands do not contain control characters and implement validation on user inputs.
What software is affected by CVE-2025-15366?
CVE-2025-15366 affects the imaplib module in Python packages that utilize this library.
What are the potential consequences of CVE-2025-15366?
The potential consequences of CVE-2025-15366 include arbitrary command execution and manipulation of IMAP commands.
Is CVE-2025-15366 easy to exploit?
Exploitation of CVE-2025-15366 can be relatively straightforward if user input is not properly sanitized.