RCE in Python Software Foundation Cpython
CVE-2025-15366
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (34.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 34.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Python Software Foundation Cpython — versions 3.14.0, 0, 3.15.0a1
Weakness classification (CWE)
References
- github.com/python/cpython/issues/143921 (issue-tracking)
- github.com/python/cpython/pull/143922 (patch)
- mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXM… (vendor-advisory)
- github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45 (patch)
- github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649d (patch)
- github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736a (patch)
- github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1 (patch)
- github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2 (patch)