The imaplib module in CPython allows command injection when it processes user-supplied commands containing newline characters, enabling attackers to inject additional commands. This is due to improper neutralization of special elements (CWE-77). The vulnerability is mitigated by rejecting commands that contain control characters. The affected versions include 0, 3.15.0a1, and 3.14.0. The CVSS 4.0 base score is 5.9, indicating a medium severity vulnerability with network attack vector, low complexity, partial privileges required, no user interaction, and limited confidentiality and high integrity and availability impacts.

An attacker with partial privileges can inject additional commands into the imaplib module by exploiting newline characters in user-controlled input. This could lead to unauthorized command execution within the context of the affected Python process, potentially impacting integrity and availability. Confidentiality impact is low, and no privilege escalation or user interaction is required.

No official patch or fix is currently referenced. Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. The known mitigation is to reject commands containing control characters to prevent injection. Users should monitor vendor advisories for updates and apply any forthcoming official fixes.