PraisonAI IMAP SEARCH Injection via Unsanitized Agent Email Tool Parameters
First seen Sep 15, 2026 · Updated Sep 15, 2026 · CVSS 8.1
PraisonAI's email tools build IMAP SEARCH commands by directly inserting LLM-generated text (from addresses, subjects, queries) into quoted search criteria without sanitization. An attacker who can influence what the LLM outputs (e.g., via prompt injection from an email body or a malicious tool response) can break out of the intended search criterion and manipulate the underlying IMAP session, leading to unauthorized mailbox access, data modification, deletion, or denial of service. This is fixed in praisonaiagents 1.6.59.
Technical Analysis
The vulnerability lies in src/praisonai-agents/praisonaiagents/tools/email_tools.py, where values controlled by the LLM (from_addr, subject, query) are interpolated into quoted IMAP SEARCH criteria without escaping quotes, backslashes, newlines, or null bytes. Because these values originate from LLM output, which is itself influenced by untrusted inputs such as email content processed by the agent (a classic indirect prompt injection vector), an attacker can craft email content or conversational input that causes the LLM to emit strings breaking out of the intended search term. This crosses the boundary from LLM output to a stateful backend protocol (IMAP), effectively turning agent tool use into a protocol injection attack against the mail server, and can grant read/write/delete access to any mailbox the configured credentials can reach. The attack surface spans the tool layer (unsanitized tool implementation) but is triggered through the model/planner boundary, making it a hybrid of tool-misuse and injection-driven escalation.
Affected Systems
PraisonAI, praisonaiagents; protocols: IMAP
Detection Signatures
- Search logs for IMAP SEARCH commands containing unescaped quote ("), backslash (\\), CR/LF, or null byte sequences in from_addr, subject, or query fields.
- Monitor for anomalous IMAP SEARCH criteria with unbalanced quotes or embedded control characters.
- Flag agent tool invocations of search_emails, reply_email, archive_email where input parameters were derived from untrusted or externally-sourced content (e.g., email bodies).
- Audit for praisonaiagents versions prior to 1.6.59 in dependency manifests (requirements.txt, poetry.lock, package registries).
Remediation Steps
- 1
Upgrade praisonaiagents
Update to praisonaiagents version 1.6.59 or later, which fixes the IMAP SEARCH interpolation issue.
- 2
Sanitize/escape tool inputs
Ensure any LLM-generated or externally-sourced values passed into IMAP or other protocol commands are properly escaped or validated before use, rejecting or encoding quotes, backslashes, and control characters.
- 3
Apply least privilege to email credentials
Restrict the IMAP account used by agents to minimum necessary mailbox access and permissions, limiting blast radius if injection succeeds.
- 4
Treat email content as untrusted input
Implement input validation and prompt injection defenses for any agent workflow that processes incoming email content, since email bodies are attacker-controllable and can influence LLM output used in tool calls.
- 5
Add integration tests for protocol injection
Include test cases with malicious quote/escape sequences in from_addr, subject, and query fields to verify the fix and prevent regression.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.