CVE-2026-57130: PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/emailtools.py interpolates LLM-controlled fromaddr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when searchemails, replyemail, or archiveemail is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.59
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using praisonaiagents before 1.6.59 are exposed if an agent can access search_emails, reply_email, or archive_email and has configured email credentials. The vulnerable path requires LLM-controlled from_addr, subject, or query values to reach the email tools.
What does an attacker need to exploit this issue?
An attacker needs the ability to influence values supplied by the LLM to the affected email-search functionality. They do not need user interaction, but exploitation depends on the affected tools being exposed to an agent with working mailbox credentials.
What could exploitation allow?
Injected quote, backslash, newline, or null characters can escape the intended IMAP SEARCH criterion and alter IMAP operations. This can enable mailbox data access, modification, deletion, or disruption of the IMAP connection.
What is the remediation?
Upgrade praisonaiagents to version 1.6.59, which fixes the issue. If an immediate upgrade is not possible, avoid exposing search_emails, reply_email, and archive_email to agents that process untrusted or attacker-influenced input, and remove configured email credentials from those agents where feasible.