CVE-2026-57130

An injection flaw in PraisonAI's praisonaiagents library (versions before 1.6.59) interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria in email_tools.py without escaping. An attacker who can influence an agent's inputs — for example, via prompt injection embedded in email content or task text — can include quote, backslash, newline, or null characters to escape the intended criterion and alter IMAP operations whenever search_emails, reply_email, or archive_email runs on an agent with configured email credentials. Successful exploitation allows access to, modification of, or deletion of mailbox data beyond the intended scope, or disruption of the mail connection, reflected in a high CVSS 3.1 score of 8.1. Only deployments running praisonaiagents < 1.6.59 that expose the email tools to an agent are affected, and the issue is fixed in version 1.6.59. No public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade praisonaiagents to version 1.6.59 or later as soon as possible. If upgrading is delayed, stop exposing the search_emails, reply_email, and archive_email tools to agents, and scope agent email credentials to least-privilege mailboxes. Review mailbox and IMAP server logs for unexpected SEARCH, STORE, or EXPUNGE operations, and treat agent-visible email content as untrusted prompt-injection input.