https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 23:08:28 +0000 https://db.gcve.eu/vuln/cve-2026-42257 <p><strong>Affected:</strong> ruby net-imap</p> <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.</p> <p><strong>Affected:</strong> ruby net-imap</p> <p>Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.</p> https://db.gcve.eu/vuln/cve-2026-42257 https://db.gcve.eu/vuln/ghsa-hm49-wcqc-g2xg <p><strong>Affected:</strong> RubyGems: net-imap</p> <p>### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.</p> <p>### Details</p> <p>`Net::IMAP`&#39;s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection&#39;s UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.</p> <p>But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket: * `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread` * when `criteria` is a String, it is sent raw * `#uid_fetch`, `#fetch * when `attr` is a String, it is sent raw * when `attr` is an Array, each String in `attr` is sent raw * `#uid_store`, `#store` * when `attr` is a String, it is sent raw * `#setquota`: * `limit` is interpolated with `#to_s` and that string is sent raw</p> <p>Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.</p> <p>Using \&#34;raw data\&#34; arguments for `#uid_store`, `#sto…</p> <p><strong>Affected:</strong> RubyGems: net-imap</p> <p>### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.</p> <p>### Details</p> <p>`Net::IMAP`&#39;s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection&#39;s UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.</p> <p>But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket: * `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread` * when `criteria` is a String, it is sent raw * `#uid_fetch`, `#fetch * when `attr` is a String, it is sent raw * when `attr` is an Array, each String in `attr` is sent raw * `#uid_store`, `#store` * when `attr` is a String, it is sent raw * `#setquota`: * `limit` is interpolated with `#to_s` and that string is sent raw</p> <p>Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.</p> <p>Using \&#34;raw data\&#34; arguments for `#uid_store`, `#sto…</p> https://db.gcve.eu/vuln/ghsa-hm49-wcqc-g2xg