Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M
CVE-2026-47242Net::IMAP: Command Injection via ID command argument
Medium 5.8
In plain English
A medium-severity command injection in net-imap from ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.8Medium
Exploit odds (30 days)0.2%top 92.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences. While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands. This vulnerability is fixed in 0.6.5 and 0.5.15.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | ruby | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | ruby | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | ruby-bundled-gems | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-bundled-gems | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-bundled-gems | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | ruby-bundled-gems | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | ruby-default-gems | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-default-gems | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-default-gems | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | ruby-default-gems | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | ruby-devel | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-devel | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-devel | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | ruby-devel | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | ruby-doc | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-doc | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-doc | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | ruby-doc | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | ruby-libs | 3.3.12-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | ruby-libs | 3.3.12-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | ruby-libs | 4.0.6-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | ruby-libs | 3.3.12-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | ruby4.0 | 4.0.6-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-devel | 4.0.6-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-doc | 4.0.6-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-rubygem-mysql2 | 0.5.7-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:10 | ruby4.0-rubygem-pg | 1.6.3-36.el10_2 | ALSA-2026:50773 |
| AlmaLinux:8 | rubygem-abrt | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:10 | rubygem-bigdecimal | 3.1.5-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-bigdecimal | 3.1.5-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-bigdecimal | 3.1.5-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-bigdecimal | 4.0.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-bundler | 2.5.22-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-bundler | 2.5.22-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-bundler | 2.5.22-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-bundler | 4.0.16-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-io-console | 0.7.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-io-console | 0.7.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-io-console | 0.8.2-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-io-console | 0.7.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-irb | 1.13.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-irb | 1.13.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-irb | 1.13.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-irb | 1.16.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-json | 2.7.2-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-json | 2.7.2-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-json | 2.18.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-json | 2.7.2-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-minitest | 5.20.0-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-minitest | 5.20.0-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-minitest | 6.0.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-minitest | 5.20.0-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.7-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.7-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:50828 |
| AlmaLinux:8 | rubygem-pg | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-pg | 1.6.3-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-pg | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:50828 |
| AlmaLinux:8 | rubygem-pg-doc | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-pg-doc | 1.6.3-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-pg-doc | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-power_assert | 2.0.3-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-power_assert | 2.0.3-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-power_assert | 2.0.3-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-power_assert | 3.0.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-psych | 5.1.2-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-psych | 5.1.2-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-psych | 5.3.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-psych | 5.1.2-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-racc | 1.7.3-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-racc | 1.7.3-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-racc | 1.7.3-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-racc | 1.8.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-rake | 13.1.0-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rake | 13.1.0-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rake | 13.3.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-rake | 13.1.0-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-rbs | 3.4.0-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rbs | 3.4.0-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rbs | 3.10.0-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:9 | rubygem-rbs | 3.4.0-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:10 | rubygem-rdoc | 6.6.3.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rdoc | 6.6.3.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rdoc | 6.6.3.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-rdoc | 7.0.4-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-rexml | 3.4.4-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rexml | 3.4.4-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rexml | 3.4.4-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-rexml | 3.4.4-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-rss | 0.3.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-rss | 0.3.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-rss | 0.3.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-rss | 0.3.2-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-test-unit | 3.6.1-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-test-unit | 3.6.1-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-test-unit | 3.6.1-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-test-unit | 3.7.5-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygem-typeprof | 0.21.9-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygem-typeprof | 0.21.9-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygem-typeprof | 0.21.9-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygem-typeprof | 0.31.1-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygems | 3.5.22-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygems | 3.5.22-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygems | 3.5.22-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygems | 4.0.16-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| AlmaLinux:10 | rubygems-devel | 3.5.22-14.el10_2 | ALSA-2026:50778 |
| AlmaLinux:8 | rubygems-devel | 3.5.22-8.module_el8.10.0+4241+4264e34b | ALSA-2026:50728 |
| AlmaLinux:9 | rubygems-devel | 3.5.22-8.module_el9.8.0+288+22f1c9f2 | ALSA-2026:50828 |
| AlmaLinux:9 | rubygems-devel | 4.0.16-34.module_el9.8.0+289+5a070f48 | ALSA-2026:50827 |
| Alpine:v3.21 | ruby-net-imap | 0.4.25-r0 | ALPINE-CVE-2026-47242 |
| Alpine:v3.22 | ruby-net-imap | 0.5.15-r0 | ALPINE-CVE-2026-47242 |
| Alpine:v3.23 | ruby-net-imap | 0.5.15-r0 | ALPINE-CVE-2026-47242 |
| Alpine:v3.24 | ruby-net-imap | 0.5.15-r0 | ALPINE-CVE-2026-47242 |
| Debian:12 | ruby3.1 | no fix listed | DEBIAN-CVE-2026-47242 |
| Debian:13 | ruby3.3 | no fix listed | DEBIAN-CVE-2026-47242 |
| Debian:14 | ruby3.3 | no fix listed | DEBIAN-CVE-2026-47242 |
| Rocky Linux:10 | ruby | 0:3.3.12-14.el10_2 | RLSA-2026:50778 |
| Rocky Linux:8 | ruby | 0:3.3.12-8.module+el8.10.0+40269+dc93e2d1 | RLSA-2026:50728 |
| Rocky Linux:9 | ruby | 0:3.3.12-8.module+el9.8.0+40270+7a73441e | RLSA-2026:50828 |
| Rocky Linux:9 | ruby | 0:4.0.6-34.module+el9.8.0+40271+b5850c84 | RLSA-2026:50827 |
| Rocky Linux:10 | ruby4.0 | 0:4.0.6-36.el10_2 | RLSA-2026:50773 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1679+61871737 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1820+f3fffb92 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.9.0+1537+0b2034bd | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1826+b62220b4 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1679+61871737 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2026:50728 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.7-1.module+el9.8.0+40094+ce01217c | RLSA-2026:50827 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.5-3.module+el9.7.0+40032+36e56d0d | RLSA-2026:50828 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2026:50728 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1679+61871737 | RLSA-2026:50728 |
| Rocky Linux:9 | rubygem-pg | 0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1 | RLSA-2026:50828 |
| Rocky Linux:9 | rubygem-pg | 0:1.6.3-1.module+el9.8.0+40094+ce01217c | RLSA-2026:50827 |
| RubyGems | net-imap | 0.6.4.1 | GHSA-46q3-7gv7-qmgg |
| RubyGems | net-imap | 0.5.15 | GHSA-46q3-7gv7-qmgg |
| Ubuntu:24.04:LTS | jruby | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:25.10 | jruby | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:26.04:LTS | jruby | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:26.10 | jruby | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:22.04:LTS | ruby3.0 | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:24.04:LTS | ruby3.2 | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:25.10 | ruby3.3 | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:26.04:LTS | ruby3.3 | no fix listed | UBUNTU-CVE-2026-47242 |
| Ubuntu:26.10 | ruby3.3 | no fix listed | UBUNTU-CVE-2026-47242 |
Affected products (as reported)
Weakness: CWE-77, CWE-93 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/ruby/net-imap/security/advisories/GHSA-46q3-7gv7-qmgg x_refsource_CONFIRM