Executive brief
PraisonAI AgentMail is an AI-powered tool that processes and responds to emails. In versions prior to 4.6.78, the system fails to verify the authenticity of incoming webhooks, allowing unauthorized individuals to send fake messages to the AI agent. This could lead to the AI processing malicious instructions, leaking information to attacker-controlled addresses, or bypassing security filters designed to block specific senders.
Technical details
PraisonAI AgentMail's webhook server (aiohttp) fails to implement signature or HMAC verification for inbound 'message.received' events when running in webhook or hybrid mode. The vulnerability exists in 'src/praisonai/praisonai/bots/agentmail.py' within the '_handle_email_webhook' function, which processes JSON payloads without authentication. An unauthenticated remote attacker can POST crafted JSON payloads to the /webhook endpoint to spoof the 'from' address and inject arbitrary message content. This allows for the bypass of sender allow/block lists, potential prompt injection, and redirection of agent responses to attacker-controlled destinations. The issue is resolved in version 4.6.78.
Affected products
- MervinPraison PraisonAI AgentMail < 4.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: NVD publication date