CVE-2026-57130 Overview
CVE-2026-57130 is an IMAP command injection vulnerability in PraisonAI, a multi-agent teams framework. Versions of praisonaiagents prior to 1.6.59 interpolate LLM-controlled values directly into quoted IMAP SEARCH criteria within src/praisonai-agents/praisonaiagents/tools/email_tools.py. An attacker who influences agent inputs can inject quote, backslash, newline, or null characters to escape the intended search criterion. This affects the search_emails, reply_email, and archive_email functions when exposed to an agent with configured email credentials.
Critical Impact
Successful exploitation allows unauthorized mailbox data access, modification, deletion, or IMAP connection disruption through prompt-driven injection into email tool calls.
Affected Products
- PraisonAI praisonaiagents package versions prior to 1.6.59
- Deployments exposing search_emails, reply_email, or archive_email tools to agents
- Agent configurations with active IMAP email credentials
Discovery Timeline
- 2026-09-14 - CVE-2026-57130 published to the National Vulnerability Database (NVD)
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-57130
Vulnerability Analysis
The vulnerability resides in the email tools module of the praisonaiagents package. The email_tools.py file constructs IMAP SEARCH commands by directly interpolating three parameters — from_addr, subject, and query — into quoted search criteria. Because these values are controlled by the large language model (LLM) driving the agent, an adversary who can influence agent prompts can inject IMAP protocol metacharacters.
The IMAP SEARCH command uses quoted strings as arguments. Embedded double quotes, backslashes, newlines, or null bytes break out of the quoted context and let an attacker append or replace search criteria. This constitutes an input validation failure classified as [CWE-20].
The issue applies whenever an agent operator exposes the affected tools with valid IMAP credentials. Because agents commonly process untrusted content such as inbound emails or web-retrieved data, prompt injection provides a practical path to triggering the flaw.
Root Cause
The root cause is unsanitized interpolation of LLM-provided strings into IMAP SEARCH criteria. The code does not escape or reject characters that carry syntactic meaning in the IMAP protocol, and it trusts the agent-supplied values to remain within their intended quoted boundaries.
Attack Vector
An attacker delivers crafted content — for example, a malicious email or web document — that the target agent ingests. Through prompt injection, the attacker directs the agent to invoke search_emails, reply_email, or archive_email with payloads containing quote or control characters. The manipulated criteria then execute against the victim's mailbox, enabling data exfiltration, message deletion, unintended replies, or disruption of the IMAP session.
No synthetic exploitation code is reproduced here. Refer to the GitHub Security Advisory GHSA-c969-5x3p-vq3v for maintainer analysis.
Detection Methods for CVE-2026-57130
Indicators of Compromise
- IMAP server logs containing SEARCH commands with unusual quote, backslash, newline, or null-byte sequences
- Unexpected mailbox activity such as bulk reads, deletions, or outbound replies originating from agent service accounts
- Agent audit logs showing search_emails, reply_email, or archive_email calls with malformed from_addr, subject, or query values
Detection Strategies
- Inventory PraisonAI deployments and identify agents configured with email credentials and the affected tools enabled
- Instrument tool-call telemetry to capture arguments passed to email functions and flag non-printable or protocol-metacharacter content
- Correlate LLM prompt inputs with subsequent IMAP operations to identify prompt-injection patterns
Monitoring Recommendations
- Enable verbose logging on IMAP servers used by agents and forward events to a centralized analytics platform
- Alert on anomalous message deletion, movement, or reply volume tied to agent identities
- Track deployed praisonaiagents package versions across environments to confirm patch status
How to Mitigate CVE-2026-57130
Immediate Actions Required
- Upgrade praisonaiagents to version 1.6.59 or later across all environments
- Rotate IMAP credentials used by agents that ran vulnerable versions with the affected tools exposed
- Review mailbox contents and audit logs for evidence of unauthorized access or modification
Patch Information
The maintainers fixed the issue in praisonaiagents 1.6.59. See the GitHub commit b4270173 and the PraisonAI v4.6.59 release notes for the fix details.
Workarounds
- Disable search_emails, reply_email, and archive_email tools for agents until the upgrade is applied
- Remove IMAP credentials from agent configurations that do not require email access
- Restrict agent inputs to trusted sources and apply content filtering on ingested email or web data
# Upgrade PraisonAI agents to the patched release
pip install --upgrade 'praisonaiagents>=1.6.59'
# Verify the installed version
python -c "import praisonaiagents; print(praisonaiagents.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
