The net-imap Ruby library implements IMAP client functionality. Before versions 0.6.5 and 0.5.15, the Net::IMAP#id method, when called with a hash argument, properly quoted ID field strings but did not prohibit CRLF sequences, allowing injection vectors. Similarly, Net::IMAP#enable processes arguments for aliases but does not validate them as valid atoms, sending the #to_s value verbatim. These flaws allow an attacker to inject arbitrary IMAP commands via crafted arguments. The vulnerability is addressed by fixes in versions 0.6.5 and 0.5.15.

An attacker able to supply crafted arguments to Net::IMAP#id or Net::IMAP#enable could inject arbitrary IMAP commands, potentially leading to unauthorized actions or manipulation of the IMAP session. The CVSS 5.8 (medium) reflects local attack vector with low complexity and partial user interaction required. No known exploits in the wild have been reported.

Upgrade to net-imap version 0.6.5 or 0.5.15 or later, where the vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is not explicitly confirmed in the advisory, but the description states the issue is fixed in these versions.