A high-severity IMAP command injection vulnerability in PraisonAI agents allows authenticated users to access, modify, or delete sensitive mailbox data.

The vulnerability exists in the email_tools.py component, where LLM-controlled inputs are directly interpolated into IMAP SEARCH criteria. An authenticated user can inject special characters to escape the intended query, resulting in unauthorized IMAP operations.

This vulnerability carries a CVSS score of 8.1, reflecting its high potential for impact on confidentiality and integrity. Successful exploitation permits an attacker to perform unauthorized actions within the email environment, including reading private communications, modifying messages, or disrupting connectivity, which poses a significant risk of data breach and operational downtime.

Immediate Action: Update the praisonaiagents package to version 1.6.59 or later immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Review application and IMAP server logs for abnormal search queries or repetitive command execution patterns that deviate from standard agent behavior.

Compensating Controls: Implement strict input sanitization at the agent tool level and restrict the permissions of the service accounts used by the agents to the minimum necessary for their function.

Public Exploit Available: Unknown.

Given the potential for unauthorized access to sensitive email data, organizations utilizing PraisonAI agents must prioritize upgrading to version 1.6.59. Failure to patch allows a malicious actor with authenticated access to leverage the agent to perform arbitrary IMAP operations, creating a severe security gap in the communication workflow.