RCE in Python Software Foundation Cpython
CVE-2025-15366
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.004 (28.6th percentile) — read the EPSS interpretation.
Affected products
- Python Software Foundation Cpython — versions 3.14.0, 0, 3.15.0a1
Weakness classification (CWE)
References
- cna@python.org (issue-tracking)
- cna@python.org (patch)
- cna@python.org (vendor-advisory)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)