CVE-2026-47240 is a medium-severity (CVSS 5.8) command injection vulnerability in Ruby's net-imap gem. Several Net::IMAP commands accept raw data arguments that support embedded non-synchronizing literals, but fail to verify whether the server actually supports them before sending. On servers without LITERAL+, LITERAL-, or IMAP4rev2 support, the server may interpret the literal as a malformed command and treat its contents as new pipelined commands, enabling CRLF injection attacks. Affected commands include #search, #uid_search, #sort, #thread, #fetch, and their uid variants. An attacker passing user-controlled input could inject arbitrary IMAP commands such as DELETE. The fix is to update to net-imap >= 0.6.4.1 or ~> 0.5.15. Workarounds include validating inputs to prohibit CR/LF bytes or verifying server capability before using raw data arguments.
