PT-2026-53132 · Pypi · Praisonaiagents

Published

2026-06-18

·

Updated

2026-06-18

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

The email search tool in src/praisonai-agents/praisonaiagents/tools/email tools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters (from addr, subject, query) directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who can influence the arguments to the search emails or reply email tool (via crafted agent prompts) can inject arbitrary IMAP commands, potentially exfiltrating email data from other folders, deleting emails, or performing other unauthorized IMAP operations.

Details

Vulnerable code (lines 493–502):
python
criteria = []
if from addr:
  criteria.append(f'FROM "{from addr}"')
if subject:
  criteria.append(f'SUBJECT "{subject}"')
if query:
  criteria.append(f'TEXT "{query}"')
if not criteria:
  criteria.append("ALL")
search str = " ".join(criteria)
status, data = mail.search(None, search str)
The from addr, subject, and query parameters originate from LLM tool call arguments (the search emails public function at line 665). These values flow through without any sanitization or escaping. The double-quote (") characters in these parameters allow breaking out of the IMAP SEARCH quoted string context.
Additional injection points:
  • Line 416: mail.search(None, f'HEADER Message-ID "{search id}"')
  • Line 447: Same pattern in smtp reply email
  • Line 542: Same pattern in smtp archive email
The search id / message id parameter in these functions is also LLM-controlled via the reply email and archive email public tool functions.
Reachability: The search emails, reply email, and archive email functions are exposed as agent tools. They are reachable when an agent is configured with email tools (EMAIL ADDRESS + EMAIL PASSWORD environment variables set). This is a documented deployment scenario for email-capable agents.

PoC

Setup: Requires an IMAP server (not run here — this is a static proof). The vulnerability is demonstrated by tracing the data flow.
Positive trigger — IMAP injection via search emails: An LLM agent processing a crafted prompt calls:
python
search emails(from addr='user@example.com" LOGOUT')
This produces the IMAP command:
SEARCH FROM "user@example.com" LOGOUT"
The LOGOUT command is injected after the prematurely closed quoted string, causing the IMAP connection to be terminated.
More severe injection — exfiltrate emails from another folder:
python
search emails(query='" SEARCH RETURN (MIN) ALL')
Produces: TEXT "" SEARCH RETURN (MIN) ALL" — injects a secondary SEARCH command.
Negative control — legitimate search:
python
search emails(from addr='user@example.com')
Produces: FROM "user@example.com" — correct, no injection.
Cleanup: No persistent changes for read-only injection. For destructive injection (DELETE, EXPUNGE), impact persists.

Impact

An attacker who can craft prompts that cause an LLM agent to call search emails with injection payloads can:
  • Terminate IMAP connections (denial of service)
  • Inject arbitrary IMAP commands — including LIST (enumerate folders), SELECT (switch folders), FETCH (read emails from other mailboxes), STORE (modify flags), COPY/MOVE (move emails), DELETE/EXPUNGE (permanently delete emails)
  • Exfiltrate email contents from folders the user did not intend to expose to the agent
  • Permanently delete emails via injected DELETE + EXPUNGE commands
The attack requires the IMAP backend to be configured (EMAIL ADDRESS + EMAIL PASSWORD env vars), which is a documented and common deployment for email-capable agents.

Suggested remediation

  1. Escape double-quote characters in IMAP parameters. Per RFC 3501, literal strings use {n}r format or quoted strings with `` escaping:
python
def escape imap string(s: str) -> str:
  """Escape a string for safe use in IMAP quoted strings."""
  # Use IMAP literal syntax for safety: {length}r
<data>
  encoded = s.encode('utf-8')
  return f'{{{len(encoded)}}}r
{encoded}'
  1. Use IMAP literal syntax ({n}r data) instead of quoted strings for all user-controlled parameters. This prevents any injection regardless of content.
  2. Apply the escaping to all IMAP search criteria parameters: from addr, subject, query, and search id/message id.

Fix

Command Injection

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-77CWE-20

Related Identifiers

GHSA-C969-5X3P-VQ3V

Affected Products

Praisonaiagents