Skip to content
Threat Feed
Subscribe

Product

Praisonaiagents (<= 1.6.48)

1 brief RSS
high advisory

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

A command injection vulnerability (CVE-NONE) exists in PraisonAI's `praisonaiagents` package (versions <= 1.6.48) where unsanitized LLM-controlled parameters are directly interpolated into IMAP SEARCH commands, allowing attackers to craft malicious prompts to inject arbitrary IMAP commands, leading to unauthorized email exfiltration, deletion, or denial-of-service when email tools are configured.

praisonaiagents command-injection llm-agent imap email data-exfiltration
3r 4t