CVE-2026-42257

Katalog CVE

CVSS 9.8 · Critical EPSS 0,52%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada ruby-lang net. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.

Rincian

Terbit di NVD

9 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg mitigasi · advisory vendor
• https://github.com/ruby/net-imap/releases/tag/v0.4.24 release notes
• https://github.com/ruby/net-imap/releases/tag/v0.5.14 release notes
• https://github.com/ruby/net-imap/releases/tag/v0.6.4 release notes