---
title: "CVE-2026-47240 (net-imap): Net::IMAP: Command Injection via non-synchronizing literal in \"raw\" argument"
url: https://daily.dev/posts/cve-2026-47240-net-imap-net-imap-command-injection-via-non-synchronizing-literal-in-raw-argum-iljrz19hy
source_url: https://rubysec.com/advisories/CVE-2026-47240
type: article
source: "RUBYLAND"
published: 2026-06-13T14:24:42.610Z
updated: 2026-06-13T14:25:08.208Z
tags: ["security", "ruby"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE-2026-47240 (net-imap): Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

**[RUBYLAND](https://daily.dev/sources/rubyla)** · 3 min read · 0 upvotes · 0 comments

## Summary

CVE-2026-47240 is a medium-severity (CVSS 5.8) command injection vulnerability in Ruby's net-imap gem. Several Net::IMAP commands accept raw data arguments that support embedded non-synchronizing literals, but fail to verify whether the server actually supports them before sending. On servers without LITERAL+, LITERAL-, or IMAP4rev2 support, the server may interpret the literal as a malformed command and treat its contents as new pipelined commands, enabling CRLF injection attacks. Affected commands include #search, #uid_search, #sort, #thread, #fetch, and their uid variants. An attacker passing user-controlled input could inject arbitrary IMAP commands such as DELETE. The fix is to update to net-imap >= 0.6.4.1 or ~> 0.5.15. Workarounds include validating inputs to prohibit CR/LF bytes or verifying server capability before using raw data arguments.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://rubysec.com/advisories/CVE-2026-47240>

## Similar posts on daily.dev

- [CVE-2026-47242 \(net-imap\): Net::IMAP: Command Injection via ID command argument](https://daily.dev/posts/cve-2026-47242-net-imap-net-imap-command-injection-via-id-command-argument-citzupwdq) · RUBYLAND · 0 upvotes · 0 comments
- [CVE-2026-47241 \(net-imap\): Net::IMAP: Denial of Service via incomplete raw argument validation](https://daily.dev/posts/cve-2026-47241-net-imap-net-imap-denial-of-service-via-incomplete-raw-argument-validation-fpkbpelcz) · RUBYLAND · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby)

[View this post on daily.dev](https://daily.dev/posts/cve-2026-47240-net-imap-net-imap-command-injection-via-non-synchronizing-literal-in-raw-argum-iljrz19hy)