Python -- imaplib module, when passed a user-controlled command, can have additional commands injected using newlines

2026-04-01 · CVE-2025-15366 · VuXML entry

Python Software Foundation Security Developer reports: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing specific control characters.

Affected versions

• python310 >= 0
• python311 >= 0
• python312 >= 0
• python313 < 3.13.15
• python313t < 3.13.15
• python314 < 3.14.7
• python314t < 3.14.7
• python315 < 3.15.0.b4

By system

9 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.