Related Vulnerabilities: CVE-2018-14357  

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.

Severity High

Remote Yes

Type Arbitrary command execution

Description

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.

AVG-740 neomutt 20180622-2 20180716-1 High Fixed

https://github.com/neomutt/neomutt/commit/e52393740334443ae0206cab2d7caef381646725
https://gitlab.com/muttmua/mutt/commit/185152818541f5cdc059cbff3f3e8b654fc27c1d