Email Manipulation Vulnerability in PraisonAI by Mervin Praison

CVE-2026-57130

What is CVE-2026-57130?

PraisonAI's email tools contained a vulnerability that allows LLM-controlled values to be improperly processed within IMAP SEARCH criteria. Prior to version 1.6.59, this flaw enabled agents to inject harmful content through embedded special characters, which could manipulate search results or alter email handling functions. This exposure could potentially lead to unauthorized access, modification, or deletion of mailbox data, as well as disrupt email connections. The issue has been addressed in the latest release, emphasizing the need for users to update to enhance security.

References