{"data":{"id":"0300cf16-2d47-4f20-bf0a-4d041e5afa29","title":"GHSA-fq4x-789w-jg5h: AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)","summary":"AgenticMail's inbound mail handlers act on privileged effects without verifying the sender is the operator. In a configured headless-bridge deployment, an external email routed to the bridge inbox makes the dispatcher resume the operator's Claude Code session with permissionMode 'bypassPermissions', embedding the attacker-controlled from, subject and preview verbatim into the prompt. The gap is structural: the bridge-wake path lacks the isOperatorReplySender check that its sibling operator-query reply hook uses in the same repo.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-fq4x-789w-jg5h","publishedAt":"2026-06-18T17:21:27.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["@agenticmail/openclaw@< 0.5.71 (fixed: 0.5.71)","@agenticmail/codex@< 0.1.33 (fixed: 0.1.33)","@agenticmail/claudecode@< 0.2.39 (fixed: 0.2.39)","@agenticmail/core@< 0.9.43 (fixed: 0.9.43)"],"affectedPackageNames":["@agenticmail/openclaw","@agenticmail/codex","@agenticmail/claudecode","@agenticmail/core"],"affectedPackageRefs":["npm:@agenticmail/core","npm:@agenticmail/claudecode","npm:@agenticmail/codex","npm:@agenticmail/openclaw"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","AgenticMail"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-fq4x-789w-jg5h"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-18T17:21:27.000Z","fixReleasedAt":"2026-06-18T04:38:53.687Z","daysToFix":0,"fixCheckedAt":"2026-10-29T21:34:17.905Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"@agenticmail/openclaw","fixedVersion":"0.5.71","matchedVersion":"0.5.71","fixReleasedAt":"2026-06-18T04:39:23.980Z","daysToFix":0,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:17.742Z"},{"ecosystem":"npm","name":"@agenticmail/core","fixedVersion":"0.9.43","matchedVersion":"0.9.43","fixReleasedAt":"2026-06-18T04:38:53.687Z","daysToFix":0,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:17.742Z"},{"ecosystem":"npm","name":"@agenticmail/claudecode","fixedVersion":"0.2.39","matchedVersion":"0.2.39","fixReleasedAt":"2026-06-18T04:39:07.489Z","daysToFix":0,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:17.742Z"},{"ecosystem":"npm","name":"@agenticmail/codex","fixedVersion":"0.1.33","matchedVersion":"0.1.33","fixReleasedAt":"2026-06-18T04:39:15.927Z","daysToFix":0,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:17.742Z"}]}}