CVE-2026-57130 PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
Attackers can inject IMAP commands via unsanitized email search parameters in PraisonAI, leading to mailbox data access, modification, or deletion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57130?
CVE-2026-57130 is a high-severity command injection vulnerability in MervinPraison praisonaiagents, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_email is exposed to an agent with configured email credentials, allowing mailbox data access, modification, deletion, or connection disruption. This issue is fixed in praisonaiagents 1.6.59.
Which versions are affected by CVE-2026-57130?
3 open source packages ship an affected version, including praisonaiagents.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.6.59 |
praisonaiagents PyPI | All versions | 1.6.59 |
praisonaiagents PyPI | All versions | 1.6.59 |
How do I fix CVE-2026-57130?
Upgrade praisonaiagents to 1.6.59 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-57130 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57130 exists.
Sources
Also known as GHSA-c969-5x3p-vq3v, PYSEC-2026-3532.