CVE-2026-57495

Received Received - Intake

Indirect Prompt Injection in AgenticMail Components

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher to resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding the attacker-controlled `from`/`subject`/`preview` verbatim into the prompt the resumed agent reads — an indirect prompt injection into a fully-privileged agent (Bash/Write/Edit/WebFetch + the agenticmail MCP toolbelt) running as the operator's OAuth identity. The sibling operator-query email-reply hook gates the same untrusted-From provenance with `isOperatorReplySender(replyFrom, config.operatorEmail)` (fail-closed); the bridge-wake path — a strictly higher-privilege effect — has no equivalent. @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71 contain a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-57495

Affected Vendors & Products

Vendor	Product	Version / Range
agenticmail	claudecode	to 0.2.39 (exc)
agenticmail	codex	to 0.1.33 (exc)
agenticmail	core	to 0.9.43 (exc)
agenticmail	openclaw	to 0.5.71 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves AgenticMail packages where inbound email handlers process privileged effects without verifying the sender's identity. An attacker can send an email to the bridge inbox, which resumes a privileged Claude Code session with bypassed permissions. The attacker-controlled email content (from, subject, preview) is embedded into the prompt, enabling indirect prompt injection into a fully privileged agent running as the operator's OAuth identity.

Detection Guidance

This vulnerability involves indirect prompt injection via email handling in AgenticMail components. Detection requires checking installed versions of affected packages (@agenticmail/claudecode, @agenticmail/codex, @agenticmail/core, @agenticmail/openclaw) and verifying they are updated to patched versions (0.2.39, 0.1.33, 0.9.43, 0.5.71 respectively). No specific network commands are provided in the context.

Impact Analysis

An attacker could gain control of your privileged AI agent, allowing them to execute commands with your permissions. This could lead to unauthorized access to sensitive data, execution of malicious actions, or further compromise of your systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance due to potential breaches of confidentiality and integrity of sensitive information.

Mitigation Strategies

Update all affected AgenticMail packages to the fixed versions: @agenticmail/claudecode to 0.2.39 or later, @agenticmail/codex to 0.1.33 or later, @agenticmail/core to 0.9.43 or later, and @agenticmail/openclaw to 0.5.71 or later.

Hi! I’m here to help you understand CVE-2026-57495. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70