CVE-2026-57130 in praisonaiagents
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in PraisonAI prior to version 1.6.59 represents a critical injection flaw within the email tooling subsystem of its multi-agent architecture. PraisonAI operates as a complex system where various autonomous agents collaborate, often requiring access to external services such as email platforms for communication and data retrieval tasks. The specific weakness resides in the src/praisonai-agents/praisonaiagents/tools/email_tools.py module, which handles interactions with Internet Message Access Protocol servers. When an agent is configured with valid email credentials and tasked with operations like searching emails, replying to messages, or archiving content, the system constructs IMAP SEARCH commands dynamically based on inputs derived from Large Language Model outputs. These inputs include parameters such as the sender address, subject line, and search query strings. The critical technical flaw lies in how these LLM-controlled values are interpolated into the IMAP command structure. Specifically, the code embeds user-supplied or model-generated data directly into quoted IMAP SEARCH criteria without adequate sanitization or escaping of special characters that hold syntactic meaning within the IMAP protocol specification.
This lack of proper input validation allows for an IMAP injection attack vector where malicious actors can manipulate the intended search logic by injecting specific control characters. The vulnerability is exploitable through embedded quote marks, backslashes, newline characters, and null bytes. In standard IMAP syntax, quoted strings are delimited by double quotes, and certain characters within those strings require escaping to maintain their literal meaning rather than being interpreted as command delimiters or structural markers. By injecting a closing quote character followed by additional commands or modifiers, an attacker can break out of the intended search parameter context. For instance, inserting a backslash-quote sequence or a newline character can terminate the original criterion and introduce new IMAP clauses that alter the scope of the operation. This capability effectively allows the injection of arbitrary IMAP commands into the session initiated by the vulnerable function. The presence of null characters further complicates parsing in some implementations, potentially leading to buffer overflows or unexpected truncation behaviors depending on how the underlying library handles string termination.
The operational impact of this vulnerability is severe due to the high privileges typically associated with email account access within an enterprise or personal automation workflow. If a PraisonAI agent exposes functions such as search_emails, reply_email, or archive_email and these are triggered by inputs influenced by LLM outputs that can be manipulated via prompt injection or other means, the consequences extend beyond simple data leakage. An attacker could execute arbitrary IMAP commands against the mailbox server. This includes reading sensitive private communications by expanding search scopes to include all messages rather than just those matching a specific query. It also permits modification of email states, such as marking messages as read or unread, and deletion of critical correspondence which can disrupt business operations or destroy evidence in forensic scenarios. Furthermore, connection disruption is possible if the injected commands cause syntax errors that terminate the IMAP session unexpectedly, leading to denial-of-service conditions for legitimate users relying on automated email processing. The risk is amplified by the fact that LLMs are probabilistic and may occasionally generate outputs containing these special characters when prompted with ambiguous or adversarial instructions, making this a realistic threat in production environments where agents operate autonomously without strict human oversight of every output token.
Mitigation strategies must focus on both immediate patching and long-term architectural hardening. The primary remediation is to upgrade the praisonaiagents package to version 1.6.59 or later, as this release addresses the interpolation flaw by implementing proper escaping mechanisms for special characters within IMAP search criteria. Beyond updating dependencies, developers should enforce strict input validation on all data passed from LLM outputs to external protocol interfaces. This involves whitelisting allowed characters in query parameters and ensuring that any necessary special characters are escaped according to RFC 3501 standards before being embedded into command strings. Additionally, implementing principle of least privilege for the email accounts used by agents can limit the blast radius; restricting access to read-only operations where possible reduces the impact of successful exploitation. Monitoring logs for anomalous IMAP activity patterns, such as unusually broad search queries or frequent session terminations, provides an additional layer of defense-in-depth. Security teams should also review agent configurations to ensure that sensitive credentials are not hardcoded and that agents operate within isolated environments with limited network egress capabilities unless explicitly required for their function.