Most recent entries from all

BREW-imap-backup-CVE-2026-42257 — net-imap vulnerable to command Injection via "raw" arguments to multiple commands

2026-10-02T04:27:43.978753+00:00

Affected: Homebrew: imap-backup

### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.

### Details

`Net::IMAP`'s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.

But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket: * `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread` * when `criteria` is a String, it is sent raw * `#uid_fetch`, `#fetch * when `attr` is a String, it is sent raw * when `attr` is an Array, each String in `attr` is sent raw * `#uid_store`, `#store` * when `attr` is a String, it is sent raw * `#setquota`: * `limit` is interpolated with `#to_s` and that string is sent raw

Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.

Using \"raw data\" arguments for `#uid_store`, `#sto…

Withdrawn: CLEANSTART-2026-RG00675 — Security fixes for CVE-2026-33637, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, ghsa…

2026-10-02T04:27:43.978901+00:00

Withdrawn by the publisher.

Affected: CleanStart: ruby-fluentd-1.19

Multiple security vulnerabilities affect the ruby-fluentd-1.19 package. These issues are resolved in later releases. See references for individual vulnerability details.

CVE-2026-42257 — net-imap: Command Injection via "raw" arguments to multiple commands

2026-10-02T04:27:43.978949+00:00

Affected: ruby net-imap

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.