Critical
Security advisory
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-14354
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:16 UTC · Revision 1
Source evidence
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
osv:CVE-2018-14354
Complete source record
{
"id": "d56abb10b3533fb2555e6bda6a40e6b4fc494cdf7bb686cf651a2433f065bbec",
"url": "https://osv.dev/vulnerability/CVE-2018-14354",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-14354",
"summary": "An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.",
"evidence": "osv:CVE-2018-14354",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2018-14354",
"aliases": [
"CVE-2018-14354"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/muttmua/mutt",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ed9d7727dc705754871e31cb41420f0ea956495b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.10.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"mutt-1-10-rel",
"mutt-1-9-rel",
"mutt-1-8-rel",
"mutt-1-7-rel",
"mutt-1-6-rel",
"mutt-1-5-24-rel",
"mutt-1-5-22-rel",
"mutt-1-5-21-rel",
"mutt-1-5-20-rel",
"mutt-1-5-19-rel",
"mutt-1-5-18-rel",
"mutt-1-5-17-rel",
"mutt-1-5-16-rel",
"mutt-1-5-15-rel",
"mutt-1-5-6-rel",
"mutt-1-5-5-1-rel",
"mutt-1-5-5-rel",
"post-type-punning-patch",
"pre-type-punning-patch",
"mutt-1-5-4-rel",
"mutt-1-5-3-rel",
"mutt-1-5-2-rel",
"mutt-1-5-1-rel",
"mutt-1-3-27-rel",
"mutt-1-3-26-rel",
"mutt-1-3-25-rel",
"mutt-1-3-24-rel",
"mutt-1-3-23-2-rel",
"mutt-1-3-23-1-rel",
"mutt-1-3-23-rel",
"mutt-1-3-22-1-rel",
"mutt-1-3-22-rel",
"mutt-1-3-21-rel",
"mutt-1-3-20-rel",
"mutt-1-3-19-rel",
"mutt-1-3-18-rel",
"mutt-1-3-17-rel",
"mutt-1-3-16-rel",
"mutt-1-3-15-rel",
"mutt-1-3-14-rel",
"mutt-1-3-13-rel",
"mutt-1-3-12-rel",
"mutt-1-3-11-rel",
"mutt-1-3-10-rel",
"mutt-1-3-9-rel",
"mutt-1-3-8-rel",
"mutt-1-3-7-rel",
"mutt-1-3-6-rel",
"mutt-1-3-5-rel",
"mutt-1-3-4-rel",
"mutt-1-3-3-rel",
"mutt-1-3-2-rel",
"mutt-1-3-1-rel",
"mutt-1-3-rel",
"mutt-1-1-14-rel",
"mutt-1-1-13-rel",
"mutt-1-1-12-rel",
"mutt-1-1-11-rel",
"mutt-1-1-10-rel",
"mutt-1-1-9-rel",
"mutt-1-1-8-rel",
"mutt-1-1-7-rel",
"mutt-1-1-6-rel",
"mutt-1-1-5-rel",
"mutt-1-1-4-rel",
"mutt-1-1-3-rel",
"mutt-1-1-2-rel",
"mutt-1-1-1-2-rel",
"mutt-1-1-1-1-rel",
"mutt-1-1-1-rel",
"mutt-1-1-rel",
"mutt-0-96-8-rel",
"mutt-0-96-7-rel",
"mutt-0-96-6-rel",
"mutt-0-96-5-rel",
"mutt-0-96-4-rel",
"mutt-0-96-3-rel",
"mutt-0-96-2-slightly-post-release",
"mutt-0-96-1-rel",
"mutt-0-96-rel",
"mutt-0-95-rel",
"mutt-0-94-18-rel",
"mutt-0-94-17i-rel",
"mutt-0-94-16i-rel",
"mutt-0-94-15-rel",
"mutt-0-94-14-rel",
"mutt-0-94-13-rel",
"mutt-0-94-10i-rel",
"mutt-0-94-9i-p1",
"mutt-0-94-9i-rel",
"mutt-0-94-8i-rel",
"mutt-0-94-7i-rel",
"mutt-0-94-6i-rel",
"mutt-0-94-5i-rel",
"mutt-0-93-unstable",
"mutt-0-92-11i",
"mutt-0-92-10i",
"mutt-0-92-9i"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14354.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/neomutt/neomutt",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "20180716"
},
{
"fixed": "95e80bf9ff10f68cb6443f760b85df4117cb15eb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:neomutt:neomutt:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "20180716"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "95e80bf9ff10f68cb6443f760b85df4117cb15eb"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"neomutt-20180622",
"neomutt-20180512",
"neomutt-20180323",
"neomutt-20180223",
"neomutt-20171215",
"neomutt-20171208",
"neomutt-20171027",
"neomutt-20171013",
"neomutt-20171006",
"neomutt-20170912",
"neomutt-20170907",
"neomutt-20170714",
"neomutt-20170707",
"neomutt-20170609",
"neomutt-20170602",
"neomutt-20170526",
"neomutt-20170428",
"neomutt-20170421",
"neomutt-20170414",
"neomutt-20170306",
"neomutt-20170225",
"neomutt-20170206",
"neomutt-20170128",
"neomutt-20170113",
"neomutt-20161126",
"neomutt-20161104",
"neomutt-20161028",
"neomutt-20161014",
"neomutt-20161003",
"neomutt-20161002",
"neomutt-20160916",
"neomutt-20160910",
"neomutt-20160827",
"neomutt-20160822"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14354.json",
"vanir_signatures": [
{
"id": "CVE-2018-14354-40bfaf37",
"digest": {
"threshold": 0.9,
"line_hashes": [
"207714131514149770539503581689377572878",
"43456414557533690830790091068221388867",
"133078401200909009917477633096569575160",
"16426923121030229350254084345547734195",
"113259863676955082336858121566925197329",
"304952015427755973249087225696281356232",
"186473608398247688801861743975973835589",
"48741560270296553278505195166830611532"
]
},
"source": "https://github.com/neomutt/neomutt/commit/95e80bf9ff10f68cb6443f760b85df4117cb15eb",
"target": {
"file": "imap/imap.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-14354-a726fb3b",
"digest": {
"length": 1416,
"function_hash": "217481649531714381706721618568270213886"
},
"source": "https://github.com/neomutt/neomutt/commit/95e80bf9ff10f68cb6443f760b85df4117cb15eb",
"target": {
"file": "imap/imap.c",
"function": "imap_subscribe"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:11:01Z"
}
},
{
"ranges": [
{
"repo": "https://gitlab.com/muttmua/mutt",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "20180716"
},
{
"fixed": "ed9d7727dc705754871e31cb41420f0ea956495b"
},
{
"fixed": "185152818541f5cdc059cbff3f3e8b654fc27c1d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:neomutt:neomutt:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "20180716"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mutt:mutt:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.10.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "185152818541f5cdc059cbff3f3e8b654fc27c1d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"mutt-1-10-rel",
"mutt-1-9-rel",
"mutt-1-8-rel",
"mutt-1-7-rel",
"mutt-1-6-rel",
"mutt-1-5-24-rel",
"mutt-1-5-22-rel",
"mutt-1-5-21-rel",
"mutt-1-5-20-rel",
"mutt-1-5-19-rel",
"mutt-1-5-18-rel",
"mutt-1-5-17-rel",
"mutt-1-5-16-rel",
"mutt-1-5-15-rel",
"mutt-1-5-6-rel",
"mutt-1-5-5-1-rel",
"mutt-1-5-5-rel",
"post-type-punning-patch",
"pre-type-punning-patch",
"mutt-1-5-4-rel",
"mutt-1-5-3-rel",
"mutt-1-5-2-rel",
"mutt-1-5-1-rel",
"mutt-1-3-27-rel",
"mutt-1-3-26-rel",
"mutt-1-3-25-rel",
"mutt-1-3-24-rel",
"mutt-1-3-23-2-rel",
"mutt-1-3-23-1-rel",
"mutt-1-3-23-rel",
"mutt-1-3-22-1-rel",
"mutt-1-3-22-rel",
"mutt-1-3-21-rel",
"mutt-1-3-20-rel",
"mutt-1-3-19-rel",
"mutt-1-3-18-rel",
"mutt-1-3-17-rel",
"mutt-1-3-16-rel",
"mutt-1-3-15-rel",
"mutt-1-3-14-rel",
"mutt-1-3-13-rel",
"mutt-1-3-12-rel",
"mutt-1-3-11-rel",
"mutt-1-3-10-rel",
"mutt-1-3-9-rel",
"mutt-1-3-8-rel",
"mutt-1-3-7-rel",
"mutt-1-3-6-rel",
"mutt-1-3-5-rel",
"mutt-1-3-4-rel",
"mutt-1-3-3-rel",
"mutt-1-3-2-rel",
"mutt-1-3-1-rel",
"mutt-1-3-rel",
"mutt-1-1-14-rel",
"mutt-1-1-13-rel",
"mutt-1-1-12-rel",
"mutt-1-1-11-rel",
"mutt-1-1-10-rel",
"mutt-1-1-9-rel",
"mutt-1-1-8-rel",
"mutt-1-1-7-rel",
"mutt-1-1-6-rel",
"mutt-1-1-5-rel",
"mutt-1-1-4-rel",
"mutt-1-1-3-rel",
"mutt-1-1-2-rel",
"mutt-1-1-1-2-rel",
"mutt-1-1-1-1-rel",
"mutt-1-1-1-rel",
"mutt-1-1-rel",
"mutt-0-96-8-rel",
"mutt-0-96-7-rel",
"mutt-0-96-6-rel",
"mutt-0-96-5-rel",
"mutt-0-96-4-rel",
"mutt-0-96-3-rel",
"mutt-0-96-2-slightly-post-release",
"mutt-0-96-1-rel",
"mutt-0-96-rel",
"mutt-0-95-rel",
"mutt-0-94-18-rel",
"mutt-0-94-17i-rel",
"mutt-0-94-16i-rel",
"mutt-0-94-15-rel",
"mutt-0-94-14-rel",
"mutt-0-94-13-rel",
"mutt-0-94-10i-rel",
"mutt-0-94-9i-p1",
"mutt-0-94-9i-rel",
"mutt-0-94-8i-rel",
"mutt-0-94-7i-rel",
"mutt-0-94-6i-rel",
"mutt-0-94-5i-rel",
"mutt-0-93-unstable",
"mutt-0-92-11i",
"mutt-0-92-10i",
"mutt-0-92-9i"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14354.json",
"vanir_signatures": [
{
"id": "CVE-2018-14354-0899ff95",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218563899158595001308791628437925633403",
"227032016281452034997778241664359416981",
"121955452387884587719052491384722837387",
"506689728705518440064826266314589397"
]
},
"source": "https://gitlab.com/muttmua/mutt@185152818541f5cdc059cbff3f3e8b654fc27c1d",
"target": {
"file": "imap/command.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-14354-10a917db",
"digest": {
"threshold": 0.9,
"line_hashes": [
"31952942522484068575409883696072157290",
"150718647487976241170236887315804442895",
"195246979766333573439280635801526022618",
"45908318597331465607108365531724022732"
]
},
"source": "https://gitlab.com/muttmua/mutt@185152818541f5cdc059cbff3f3e8b654fc27c1d",
"target": {
"file": "imap/imap_private.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-14354-62f6c109",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38275816934835526550139553849663291777",
"84668977590220873947543140367782392958",
"272858250823638590734560816738299859458",
"197331919126694590783117091847939465809",
"51941361508920648674779441686070670670",
"194784290279722335795310118604540377499",
"212420238482727122243216053129668158301",
"1736061709541927672894172239778923985",
"97656863909256314289154183120921480207"
]
},
"source": "https://gitlab.com/muttmua/mutt@185152818541f5cdc059cbff3f3e8b654fc27c1d",
"target": {
"file": "imap/imap.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-14354-632ede0e",
"digest": {
"length": 1439,
"function_hash": "42665550993922102829047012000358714254"
},
"source": "https://gitlab.com/muttmua/mutt@185152818541f5cdc059cbff3f3e8b654fc27c1d",
"target": {
"file": "imap/imap.c",
"function": "imap_subscribe"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-14354-a951c6d9",
"digest": {
"length": 417,
"function_hash": "246102907976701583778681406207369390654"
},
"source": "https://gitlab.com/muttmua/mutt@185152818541f5cdc059cbff3f3e8b654fc27c1d",
"target": {
"file": "imap/util.c",
"function": "imap_quote_string"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-14354-cc57081f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"229097236898046633024934805433464608349",
"83602381607473313393815366418147480894",
"19095377894295592758775701765302495655",
"176494269792467988790647947745744230920",
"203644126986609072164389678235740350197",
"133503302104114886261060629320855893432",
"82663813847307772799785084971472340363",
"302829093608743047112308803954531093411",
"155024479240875832356848830543203950212",
"22431226980439760116591360907198255704",
"82123232775065497543890611821024729842",
"55123122238136819455069850209539057260",
"319011740409708478183254388973645564560"
]
},
"source": "https://gitlab.com/muttmua/mutt@185152818541f5cdc059cbff3f3e8b654fc27c1d",
"target": {
"file": "imap/util.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:11:01Z"
}
}
],
"modified": "2026-10-24T14:11:01.925244179Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2018:2526",
"https://lists.debian.org/debian-lts-announce/2018/08/msg00001.html",
"https://neomutt.org/2018/07/16/release",
"https://security.gentoo.org/glsa/201810-07",
"https://usn.ubuntu.com/3719-1/",
"https://usn.ubuntu.com/3719-2/",
"https://usn.ubuntu.com/3719-3/",
"https://www.debian.org/security/2018/dsa-4277",
"https://github.com/neomutt/neomutt/commit/95e80bf9ff10f68cb6443f760b85df4117cb15eb",
"https://gitlab.com/muttmua/mutt/commit/185152818541f5cdc059cbff3f3e8b654fc27c1d"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "12.04"
},
{
"last_affected": "12.04"
},
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_aus",
"extracted_events": [
{
"range": [
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
},
{
"introduced": "7.7"
},
{
"last_affected": "7.7"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_eus",
"extracted_events": [
{
"range": [
{
"introduced": "7.5"
},
{
"last_affected": "7.5"
},
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
},
{
"introduced": "7.7"
},
{
"last_affected": "7.7"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_tus",
"extracted_events": [
{
"range": [
{
"introduced": "7.6"
},
{
"last_affected": "7.6"
},
{
"introduced": "7.7"
},
{
"last_affected": "7.7"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_workstation",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-14354",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443209,
"published_at": "2018-07-17T17:29:00.527+00:00"
}