CVE-2018-14354

CRITICAL 9.8CVE-2018-14354 · Published 17/07/2018 · updated 17/06/2026

In short

CVE-2018-14354 is a CRITICAL (CVSS 9.8) vulnerability affecting mutt (mutt), neomutt (neomutt).
Chance of exploitation in the next 30 days (EPSS): 6.2%, higher than 93.5% of all vulnerabilities.
Fix: update to 1.10.1, 20180716 or later.

Package	Affected versions	Patched versions
mutt mutt	`< 1.10.1`	`1.10.1`
neomutt neomutt	`< 20180716`	`20180716`

Description

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

References

mutt.org/news.html · Release Notes
securityfocus.com/bid/104925 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:2526 · Third Party Advisory
neomutt/neomutt commit 95e80bf · Patch
gitlab.com/muttmua/mutt/commit/185152818541f5cdc059cbff3f3e8b654fc27c1d · Patch
lists.debian.org/debian-lts-announce/2018/08/msg00001.html · Mailing List
neomutt.org/2018/07/16/release · Release Notes
security.gentoo.org/glsa/201810-07 · Third Party Advisory
usn.ubuntu.com/3719-1 · Third Party Advisory
usn.ubuntu.com/3719-2 · Third Party Advisory
usn.ubuntu.com/3719-3 · Third Party Advisory
debian.org/security/2018/dsa-4277 · Third Party Advisory

More vulnerabilities in mutt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mutt

< 1.10.1

1.10.1

neomutt

< 20180716

20180716

More vulnerabilities in mutt

See all →