Input validation and SQL injection flaws in AgenticMail API and Core (CVE-2026-47255)

Multiple improper input validation and SQL injection vulnerabilities affect the AgenticMail API and Core packages, allowing unauthenticated remote attackers to manipulate SQL commands, bypass storage ownership checks, and inject control characters into SMTP envelope and header fields before command construction. The vulnerabilities collectively expose integrity and limited availability impact across API and storage layers without requiring user interaction. Affected versions: - @agenticmail/api <= 0.9.31 - @agenticmail/core <= 0.9.9 We recommend updating to: @agenticmail/api 0.9.32, @agenticmail/core 0.9.10. CVSS 8.2 · our assessment: this_week Reference: https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf Details: https://vuln.today/cve/CVE-2026-47255