CVE-2026-57130: PraisonAI Agents IMAP injection

CISO Take

PraisonAI's email tools (search_emails, reply_email, archive_email) build raw IMAP SEARCH criteria by directly interpolating from_addr, subject, and query values that the LLM controls, so embedded quotes, backslashes, newlines, or null bytes let an attacker escape the intended search criterion and inject arbitrary IMAP operations. Any deployment where an agent has email credentials configured and processes untrusted input — including content from the inbox itself — is exposed to unauthorized mailbox read, modification, or deletion, and to connection disruption, with no authentication bypass or user interaction required (CVSS 8.1, network/low complexity). There's no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this looks like a quiet supply-chain fix rather than an active campaign, but the blast radius is anyone running praisonaiagents with an email-enabled agent. Patch by upgrading praisonaiagents to 1.6.59 or later; until then, restrict or disable the email tools for agents that ingest untrusted content, and monitor IMAP logs for malformed SEARCH commands or unexpected mailbox mutations as a compensating detection.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High severity (CVSS 8.1) driven by confidentiality and integrity impact with no privileges beyond the agent's own configured email credentials and no user interaction needed. Exploitability is straightforward for anyone who can influence the LLM-controlled from_addr/subject/query values — including via indirect prompt injection from email content the agent reads — since exploitation only requires embedding IMAP-significant characters (quotes, backslash, CRLF, NUL) rather than any deep AI/ML expertise. There is no evidence of active exploitation (not in CISA KEV, no EPSS score, no public PoC or Nuclei template), which lowers near-term urgency, but the low bar to exploit and the sensitivity of mailbox data (often containing credentials, MFA codes, and business correspondence) keep real-world risk elevated for any agent with email tool access exposed to untrusted input.

How does the attack unfold?

Malicious content delivery

Attacker sends or controls an email/value containing quote, backslash, newline, or null characters that will later be used as from_addr, subject, or query by the agent.

AML.T0051.001

Agent tool invocation

The PraisonAI agent calls search_emails, reply_email, or archive_email, passing the unsanitized attacker-influenced value into IMAP SEARCH criteria construction.

AML.T0053

IMAP criteria escape

The embedded special characters break out of the intended quoted IMAP criterion, letting the attacker append or alter IMAP search/command semantics.

Mailbox impact

The injected IMAP operations grant unauthorized access to, modification of, or deletion of mailbox data, or disrupt the IMAP connection entirely.

AML.T0086

Malicious content delivery

Attacker sends or controls an email/value containing quote, backslash, newline, or null characters that will later be used as from_addr, subject, or query by the agent.

AML.T0051.001

Agent tool invocation

The PraisonAI agent calls search_emails, reply_email, or archive_email, passing the unsanitized attacker-influenced value into IMAP SEARCH criteria construction.

AML.T0053

IMAP criteria escape

The embedded special characters break out of the intended quoted IMAP criterion, letting the attacker append or alter IMAP search/command semantics.

Mailbox impact

The injected IMAP operations grant unauthorized access to, modification of, or deletion of mailbox data, or disrupt the IMAP connection entirely.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	—	No patch
20 dependents 59% patched ~6d to patch Full package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade praisonaiagents to 1.6.59 or later, where the fix (GitHub commit b427017) properly sanitizes/escapes values before building IMAP SEARCH criteria. Until patched, disable or gate the email_tools (search_emails, reply_email, archive_email) for any agent that processes untrusted or externally-sourced content, and avoid passing raw LLM output directly as tool arguments without validation. As a workaround, add an allowlist/regex filter rejecting quote, backslash, newline, and null characters in from_addr/subject/query before they reach the IMAP client. For detection, monitor IMAP server/application logs for malformed SEARCH commands, unexpected mailbox state changes (deletions, unread/read flips), or abrupt connection resets correlated with agent activity.

How is it classified?

Data Leakage Prompt Injection DoS Agent Plugin AML.T0051.001 - Indirect AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8 - AI system operational and security controls

NIST AI RMF

MANAGE-2.3 - Mechanisms are in place to supersede, disengage, or deactivate AI systems that demonstrate unintended behavior

OWASP LLM Top 10

LLM07 - Insecure Plugin Design LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57130?

PraisonAI's email tools (search_emails, reply_email, archive_email) build raw IMAP SEARCH criteria by directly interpolating from_addr, subject, and query values that the LLM controls, so embedded quotes, backslashes, newlines, or null bytes let an attacker escape the intended search criterion and inject arbitrary IMAP operations. Any deployment where an agent has email credentials configured and processes untrusted input — including content from the inbox itself — is exposed to unauthorized mailbox read, modification, or deletion, and to connection disruption, with no authentication bypass or user interaction required (CVSS 8.1, network/low complexity). There's no EPSS data, no CISA KEV listing, and no public exploit or scanner template yet, so this looks like a quiet supply-chain fix rather than an active campaign, but the blast radius is anyone running praisonaiagents with an email-enabled agent. Patch by upgrading praisonaiagents to 1.6.59 or later; until then, restrict or disable the email tools for agents that ingest untrusted content, and monitor IMAP logs for malformed SEARCH commands or unexpected mailbox mutations as a compensating detection.

Is CVE-2026-57130 actively exploited?

No confirmed active exploitation of CVE-2026-57130 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57130?

Upgrade praisonaiagents to 1.6.59 or later, where the fix (GitHub commit b427017) properly sanitizes/escapes values before building IMAP SEARCH criteria. Until patched, disable or gate the email_tools (search_emails, reply_email, archive_email) for any agent that processes untrusted or externally-sourced content, and avoid passing raw LLM output directly as tool arguments without validation. As a workaround, add an allowlist/regex filter rejecting quote, backslash, newline, and null characters in from_addr/subject/query before they reach the IMAP client. For detection, monitor IMAP server/application logs for malformed SEARCH commands, unexpected mailbox state changes (deletions, unread/read flips), or abrupt connection resets correlated with agent activity.

What systems are affected by CVE-2026-57130?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, email-integrated agent tools, multi-agent systems.

What is the CVSS score for CVE-2026-57130?

CVE-2026-57130 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

agent frameworksemail-integrated agent toolsmulti-agent systems

MITRE ATLAS Techniques

AML.T0051.001 Indirect

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.8

NIST AI RMF: MANAGE-2.3

OWASP LLM Top 10: LLM07, LLM08

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.

Exploitation Scenario

An attacker sends an email to an inbox monitored by a PraisonAI agent, crafting the subject line or body to include IMAP-significant characters (e.g., an embedded quote followed by additional SEARCH criteria) alongside a prompt-injection instruction that gets the agent to reuse that content as a search or reply parameter. When the agent invokes search_emails or reply_email, the unsanitized value breaks out of its intended quoted IMAP criterion and the attacker's injected IMAP search terms execute with the agent's credentials — letting them enumerate or exfiltrate other messages in the mailbox, silently delete evidence of the phishing email via archive_email, or send malformed IMAP commands that disrupt the connection and degrade the agent's mail-processing capability.

Weaknesses (CWE)

CWE-20 Improper Input Validation Primary CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Primary CWE-20 Improper Input Validation CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.