GHSA-c969-5x3p-vq3v: PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

Summary The email search tool in src/praisonai-agents/praisonaiagents/tools/email_tools.py constructs IMAP SEARCH commands by interpolating LLM-controlled parameters (from_addr, subject, query) directly into IMAP protocol strings using f-string formatting with double-quote delimiters. An attacker who can influence the arguments to the search_emails or reply_email tool (via crafted agent prompts) can inject arbitrary IMAP commands, potentially exfiltrating email data from other folders, deleting emails, or performing other unauthorized IMAP operations. Details Vulnerable code (lines 493–502): criteria = [] if from_addr: criteria.append(f'FROM "{from_addr}"') if subject: criteria.append(f'SUBJECT "{subject}"') if query: criteria.append(f'TEXT "{query}"') if not criteria: criteria.append("ALL") search_str = " ".join(criteria) status, data = mail.search(None, search_str) The from_addr, subject, and query parameters originate from LLM tool call arguments (the search_emails public function at line 665). These values flow through without any sanitization or escaping. The double-quote (") characters in these parameters allow breaking out of the IMAP SEARCH quoted string context. Additional injection points: - Line 416: mail.search(None, f'HEADER Message-ID "{search_id}"') - Line 447: Same pattern in _smtp_reply_email - Line 542: Same pattern in _smtp_archive_email The search_id / message_id parameter in these functions is also LLM-controlled via the reply_email and archive_email public tool functions. Reachability: The search_emails, reply_email, and archive_email functions are exposed as agent tools. They are reachable when an agent is configured with email tools (EMAIL_ADDRESS + EMAIL_PASSWORD environment variables set). This is a documented deployment scenario for email-capable agents. PoC Setup: Requires an IMAP server (not run here — this is a static proof). The vulnerability is demonstrated by tracing the data flow. **Positive trigger — IMAP injection via se