Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-14T15:17:06.453Z",
  "pubdate": "2026-09-14T15:17:06.453Z",
  "executiveSummary": "A critical command injection vulnerability exists in praisonaiagents prior to version 1.6.59, specifically within the email interaction tools.\nThe vulnerability allows an LLM-controlled input to escape intended IMAP search criteria, potentially resulting in unauthorized access, modification, or deletion of mailbox contents.\nThe affected components include search_emails, reply_email, and archive_email functions within src/praisonai-agents/praisonaiagents/tools/email_tools.py.\nSuccessful exploitation requires that the agent has been configured with valid email credentials, providing an attacker or a malicious LLM prompt with the ability to manipulate IMAP commands sent to the mail server.\nThis flaw poses significant risks to data confidentiality and integrity, as it grants arbitrary control over mail operations by injecting escape characters such as quotes, backslashes, newlines, or null bytes into the IMAP search string.\nThe vulnerability is classified as an improper neutralization of special elements used in a command, effectively an IMAP injection attack vector.",
  "technicalDetails": "The root cause of this vulnerability is the improper sanitization of user-controllable inputs within the IMAP search construction logic in praisonaiagents/tools/email_tools.py.\nThe system takes parameters such as from_addr, subject, and query and interpolates them directly into a quoted IMAP SEARCH string without adequate escaping or validation.\nIn the IMAP protocol, SEARCH criteria are often enclosed in double quotes. By injecting characters such as double quotes (\"), backslashes (\\), newlines (\\n), or null bytes (\\0), an attacker can break out of the intended string context and append arbitrary IMAP commands or modify existing search parameters.\nThe attack flow begins when the LLM processes a prompt or an external input that is subsequently passed to an email tool function. Because the input is treated as trusted, the injected metacharacters allow the attacker to terminate the current string, inject new IMAP flags or search criteria, or force the IMAP server to interpret subsequent data as new commands.\nIf successfully exploited, an attacker could manipulate the IMAP search operation to bypass filters, access sensitive emails outside the original query scope, or perform unauthorized actions such as deleting or archiving emails by tricking the client into executing unintended operations.\nThe vulnerable code pattern fails to account for the syntax requirements of the underlying IMAP protocol, leading to command structure subversion.\nThis vulnerability is present in versions prior to 1.6.59. Exploitation is contingent upon the agent being actively configured with email credentials, effectively leveraging the agent's legitimate authenticated session to perform unauthorized operations on the mail server.\nThe post-exploitation impact includes the potential for full mailbox data exfiltration, service disruption, and the unauthorized modification of stored mail, significantly undermining the security posture of the agent's email interaction layer."
}