Homepage

Arbitrary Command Injection The advisory has been revoked - it doesn't affect any version of package logstash-9.2-env2yaml  (opens in a new tab)

Threat Intelligence

EPSS
0.43% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-LOGSTASH92ENV2YAML-16643749
  • published13 May 2026
  • disclosed9 May 2026
Report a new vulnerability Found a mistake?

Introduced: 9 May 2026

CVE-2026-42257  (opens in a new tab)
CWE-77  (opens in a new tab)
CWE-93  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream logstash-9.2-env2yaml package and not the logstash-9.2-env2yaml package as distributed by Minimos.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.