CVE-2026-42257 is a command injection flaw in the Net::IMAP gem for Ruby, scored CVSS 9.8 (critical) in the record. Several commands send a raw string to the server unchecked, so CRLF in user input can add IMAP commands. Upgrade to net-imap 0.4.24, 0.5.14 or 0.6.4.
What's affected
The advisory lists net-imap up to 0.4.23, 0.5.0 to 0.5.13 and 0.6.0 to 0.6.3. The fixed versions are 0.4.24, 0.5.14 and 0.6.4.
The commands that send raw string arguments are search and uid_search with string criteria, fetch and uid_fetch with string or array attributes, store and uid_store, and the limit in setquota. Applications are exposed only if user controlled text reaches those arguments.
How to check if you're exposed
- Find the gem version your application resolves.
bundle list | grep net-imap
gem list net-imap
- Compare it with the ranges above. Ruby also ships net-imap as a bundled gem, so check the version your runtime uses, not only your Gemfile.
- Search your code for calls to the commands above and see whether any argument is built from request data.
grep -rn "uid_search\|\.search(\|uid_fetch\|\.fetch(\|uid_store\|setquota" app lib
What to do now
- Upgrade to net-imap 0.4.24, 0.5.14 or 0.6.4, matching your line, and update the lockfile.
- Reject any CR or LF character in values you pass to these commands.
- Build search criteria and fetch attributes from fixed options, not from raw text.
- Run the mailbox account with the least rights it needs, so an injected command has limited effect.
Why it matters
The classes are CWE-77, command injection, and CWE-93, improper neutralization of CRLF sequences. Most Net::IMAP arguments are encoded safely. The listed commands treat certain strings as raw protocol text, so a line break in the value ends one command and starts another.
The advisory gives an example outcome of appending a command that deletes a mailbox. It rates the issue moderate, while the NVD record scores 9.8, since impact depends on what your code passes in. The KEV flag is false, and I found no report of exploitation in the wild.
Try it yourself
Continuous monitoring catches a gem like this when an advisory lands after you shipped.
Click through it at your own pace, or open it full screen.
Quick check
Are applications that never pass user input affected?
Only if untrusted text reaches the raw arguments. The advisory frames the risk as a developer passing unvalidated user controlled input into those arguments.
Sources
Last reviewed: 19 October 2026.
