CVE-2025-15366

IMAP command injection in user-controlled commands

State: Published
Severity: 5.9 Medium
Published: Jan 20, 2026
Updated: Aug 6, 2026
Reserved: Dec 30, 2025

Description

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.

Scores

CVSS	Score	Vector	Source
4.0	5.9 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	PSF

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
CPythonPython Software Foundation	before 3.13.15Affected 3.14.0 to before 3.14.7Affected 3.15.0a1 to before 3.15.0a6Affected

References

https://github.com/python/cpython/issues/143921issue-tracking
https://github.com/python/cpython/pull/143922patch
https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/vendor-advisory
https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45patch
https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649dpatch
https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736apatch
https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1patch
https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.