{"data":{"id":"83a01968-a41f-4c8f-b375-c58717f8c7f1","title":"CVE-2026-57495: AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39…","summary":"Two inbound-mail handlers in AgenticMail's @agenticmail/claudecode, @agenticmail/codex, @agenticmail/core and @agenticmail/openclaw packages act on privileged effects without checking that the sender is the operator, unlike a sibling handler that does. The most serious path lets any external email routed to the bridge inbox resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding attacker-controlled `from`, `subject` and `preview` fields into the prompt the agent reads.","solution":"Fixed in @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43 and @agenticmail/openclaw 0.5.71.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57495","publishedAt":"2026-07-20T22:17:17.107Z","cveId":"CVE-2026-57495","cweIds":["CWE-306"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["@agenticmail/core@< 0.9.43 (fixed: 0.9.43)","@agenticmail/claudecode@< 0.2.39 (fixed: 0.2.39)","@agenticmail/codex@< 0.1.33 (fixed: 0.1.33)","@agenticmail/openclaw@< 0.5.71 (fixed: 0.5.71)"],"affectedPackageNames":["@agenticmail/core","@agenticmail/claudecode","@agenticmail/codex","@agenticmail/openclaw"],"affectedPackageRefs":["npm:@agenticmail/core","npm:@agenticmail/claudecode","npm:@agenticmail/codex","npm:@agenticmail/openclaw"],"affectedVendors":[],"affectedVendorsRaw":["AgenticMail","@agenticmail/claudecode","@agenticmail/codex","@agenticmail/core","@agenticmail/openclaw","Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AgenticMail bridge resumes privileged sessions without sender check","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00362,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":["GHSA-fq4x-789w-jg5h"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:19.814Z","patchAvailable":true,"disclosureDate":"2026-07-20T22:17:17.107Z","fixReleasedAt":"2026-06-18T04:38:53.687Z","daysToFix":-32,"fixCheckedAt":"2026-10-29T21:32:57.073Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"@agenticmail/codex","fixedVersion":"0.1.33","matchedVersion":"0.1.33","fixReleasedAt":"2026-06-18T04:39:15.927Z","daysToFix":-32,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:56.926Z"},{"ecosystem":"npm","name":"@agenticmail/claudecode","fixedVersion":"0.2.39","matchedVersion":"0.2.39","fixReleasedAt":"2026-06-18T04:39:07.489Z","daysToFix":-32,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:56.926Z"},{"ecosystem":"npm","name":"@agenticmail/core","fixedVersion":"0.9.43","matchedVersion":"0.9.43","fixReleasedAt":"2026-06-18T04:38:53.687Z","daysToFix":-32,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:56.926Z"},{"ecosystem":"npm","name":"@agenticmail/openclaw","fixedVersion":"0.5.71","matchedVersion":"0.5.71","fixReleasedAt":"2026-06-18T04:39:23.980Z","daysToFix":-32,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:56.926Z"}]}}