EUVD-2026-77534
GHSA-c969-5x3p-vq3v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.
AnalysisAI
IMAP command injection in the PraisonAI praisonaiagents email tools before 1.6.59 lets LLM-controlled arguments (from_addr, subject, query, message_id) break out of quoted IMAP SEARCH criteria and inject arbitrary IMAP commands, giving access to, modification of, or deletion of mailbox data. Exploitation requires an agent deployed with email credentials configured (EMAIL_ADDRESS and EMAIL_PASSWORD) and with the search_emails, reply_email, or archive_email tools exposed, plus an attacker able to steer the tool-call arguments — typically via crafted or indirect prompt injection reaching the agent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Praisonaiagents
View allSSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
We need answer JSON only. Need synthesize. Need careful with fields. Let's parse input. CVE-2026-57123 PraisonAI agents
We need answer in JSON only. Need parse all data. Need produce fields exactly. Need analyze CVE-2026-57125. We need cra
Arbitrary command and code execution in PraisonAI's workflow engine (versions <4.5.139) and praisonaiagents (<1.5.140) a
Command injection in PraisonAIAgents memory hooks executor allows authenticated local attackers to execute arbitrary she
Unauthenticated remote session hijacking in PraisonAI's browser bridge (versions <4.5.139) and praisonaiagents (<1.5.140
Remote attackers can invoke arbitrary application callables in PraisonAI multi-agent systems by manipulating tool-call n
Arbitrary Python code execution in PraisonAI ≤4.5.138 occurs when malicious tools.py files are automatically imported fr
Unauthenticated MCP tool invocation in PraisonAI (praisonaiagents 0.6.0–1.6.58 and praisonai 3.10.0–4.6.58) lets a malic
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today