CVE-2025-15366 IMAP command injection in user-controlled commands
Attackers can inject IMAP commands via newlines in user-controlled input, potentially leading to code execution in applications using Python's imaplib.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-15366?
CVE-2025-15366 is a medium-severity command injection vulnerability in CPython, published on 20 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Weakness: CWE-77
Which versions are affected by CVE-2025-15366?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.15.0 |
python Bitnami | All versions | 3.15.0 |
python-min Bitnami | All versions | 3.15.0 |
Linux distribution packages (9)
python3.13 Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-debug Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-devel Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-freethreading Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-freethreading-debug Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-idle Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-libs Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-test Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
python3.13-tkinter Red Hat:hummingbird:1 | All versions | 0:3.13.12-2.hum1 |
How do I fix CVE-2025-15366?
Upgrade libpython to 3.15.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-15366 being exploited?
There is no known exploitation of CVE-2025-15366 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-15366, AZL-75029, AZL-75041, AZL-84284, BELL-CVE-2025-15366, BIT-libpython-2025-15366 and 25 more.