Vulnerability · Published Jan 20, 2026 · Assigned by PSF
CVE-2025-15366IMAP command injection in user-controlled commands
Medium 5.9
In plain English
A medium-severity command injection in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.9Medium
Exploit odds (30 days)0.4%top 62.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:8 | platform-python-debug | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:8 | platform-python-devel | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:10 | python-unversioned-command | 3.12.12-3.el10_1.1 | ALSA-2026:4713 |
| AlmaLinux:9 | python-unversioned-command | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:9 | python3 | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:9 | python3-debug | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:9 | python3-devel | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-idle | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-idle | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-libs | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-libs | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-test | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-test | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3-tkinter | 3.6.8-73.el8_10.alma.1 | ALSA-2026:2128 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-3.el9_7.1 | ALSA-2026:4168 |
| AlmaLinux:8 | python3.11 | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11 | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-debug | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-debug | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-devel | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-devel | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-idle | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-idle | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-libs | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-libs | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-rpm-macros | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:8 | python3.11-test | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-test | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.11-tkinter | 3.11.13-5.el8_10 | ALSA-2026:4473 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.13-5.1.el9_7 | ALSA-2026:4216 |
| AlmaLinux:8 | python3.12 | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12 | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-debug | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-debug | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-devel | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-devel | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-idle | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-idle | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-libs | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-libs | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:8 | python3.12-test | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-test | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.12-3.el8_10 | ALSA-2026:4463 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.12-4.el9_7.1 | ALSA-2026:4165 |
| Alpine:v3.24 | python3 | 3.14.7-r0 | ALPINE-CVE-2025-15366 |
| Debian:12 | jython | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:13 | jython | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:14 | jython | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:14 | pypy3 | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:12 | python3.11 | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:13 | python3.13 | no fix listed | DEBIAN-CVE-2025-15366 |
| Debian:14 | python3.14 | 3.14.7-1 | DEBIAN-CVE-2025-15366 |
| Rocky Linux:8 | python3 | 0:3.6.8-73.el8_10.rocky.0 | RLSA-2026:2128 |
| Rocky Linux:8 | python3.11 | 0:3.11.13-5.el8_10 | RLSA-2026:4473 |
| Rocky Linux:9 | python3.11 | 0:3.11.13-5.1.el9_7 | RLSA-2026:4216 |
| Rocky Linux:10 | python3.12 | 0:3.12.12-3.el10_1.1 | RLSA-2026:4713 |
| Rocky Linux:8 | python3.12 | 0:3.12.12-3.el8_10 | RLSA-2026:4463 |
| Rocky Linux:9 | python3.12 | 0:3.12.12-4.el9_7.1 | RLSA-2026:4165 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-3.el9_7.1 | RLSA-2026:4168 |
| Ubuntu:22.04:LTS | python2.7 | no fix listed | UBUNTU-CVE-2025-15366 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2025-15366 |
| Ubuntu:22.04:LTS | python3.11 | no fix listed | UBUNTU-CVE-2025-15366 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2025-15366 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2025-15366 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2025-15366 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.13.153.14.0 – before 3.14.73.15.0a1 – before 3.15.0a6 |
Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/issues/143921 issue-tracking
- https://github.com/python/cpython/pull/143922 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/ vendor-advisory
- https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45 patch
- https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d patch
- https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a patch
- https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1 patch
- https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2 patch