Security readout for executives and security teams
Plain-English summary
This issue affects Python applications only when they let a user influence the IMAP command sent through imaplib. Newline characters can inject extra IMAP commands. Business impact is moderate because exploitation needs a specific unsafe integration pattern and high privileges, but affected mail-processing systems should be reviewed promptly.
Executive priority
Treat as a targeted remediation item, not an emergency. Prioritize systems where users, tenants, or integrations can influence mail commands. Patch or add input rejection once Python’s affected-version guidance is confirmed.
Technical view
CVE-2025-15366 is CWE-77 command injection in CPython imaplib. If a user-controlled command contains newlines, additional IMAP commands may be injected. The stated mitigation is rejecting commands containing control characters. CVSS 4.0 score is 5.9 with network attack vector, low complexity, prerequisite conditions, high privileges, and high integrity impact.
Likely exposure
Exposure appears limited to CPython applications using imaplib and passing user-controlled values as IMAP command names. The bundle does not provide clear affected release ranges; it lists CPython with default status unaffected and patch references, so version mapping should be confirmed from Python guidance.
Exploitation context
The source bundle does not cite active exploitation, and KEV is false. Exploitation requires a vulnerable application design where an already highly privileged actor can supply command text that reaches imaplib as a command and includes control characters.
Researcher notes
The key exposure question is data flow into imaplib command parameters. The bundle supports command-injection risk and control-character rejection as mitigation, but does not clearly identify affected CPython release ranges or exploitation in the wild.
Mitigation direction
- Review the Python advisory for fixed release and branch mapping.
- Apply CPython updates containing the referenced imaplib patches.
- Stop passing user-controlled values as IMAP command names.
- Reject control characters before any value reaches imaplib command handling.
- Prioritize mail automation, gateways, and admin tools using imaplib.
Validation and detection
- Inventory Python services that import or wrap imaplib.
- Search for imaplib calls where command names are variable or user-influenced.
- Confirm runtime Python versions against the vendor advisory and patch commits.
- Add regression tests for newline and control-character rejection.
- Review logs for anomalous IMAP command sequences if exposure is confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-15366 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
5.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/issues/143921CVE reference, PSF · issue-tracking
- https://github.com/python/cpython/pull/143922CVE reference, PSF · patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45CVE reference, PSF · patch
- https://github.com/python/cpython/commit/d0921efb665aff26b378f495e5ff84f7e3fe649dCVE reference, PSF · patch
- https://github.com/python/cpython/commit/f2cd7ef89aa8a0dcbc7283bbd39548b76f2a736aCVE reference, PSF · patch
- https://github.com/python/cpython/commit/298182272a740ce2016aee2f54acbd0bba1944c1CVE reference, PSF · patch
- https://github.com/python/cpython/commit/71926d943c05bde79bd2a866933103541d91b6a2CVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.