PT-2026-45046 · Npm · @Agenticmail/Api+1
Published
2026-05-29
·
Updated
2026-05-29
·
CVE-2026-47255
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The current upstream main branch at commit 7e0206d was reviewed, and the fix-first patch set was rebased on 2026-05-18. The patches cover: validated and bound inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. Validation completed locally with targeted API/Core security tests plus API/Core builds. The security patch branch was not published publicly because te repository's SECURITY.md asks reporters not to open public vulnerability issues.
Using Hardcoded Credentials
Cleartext Transmission of Sensitive Information
RCE
Improper Access Control
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Agenticmail/Api
@Agenticmail/Core