CVE-2026-61436

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

Summary

praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches the forged message into the configured agent session and reply path.

Technical Details

The affected boundary is webhook authenticity. AgentMail's webhook verification documentation says AgentMail delivers webhooks through Svix and includes svix-id, svix-timestamp, and svix-signature headers. Receivers are expected to verify the raw request body with the endpoint signing secret, commonly stored as AGENTMAIL_WEBHOOK_SECRET, before trusting the event body. AgentMail's documented verified payload examples route on event_type; the forged payload below intentionally uses PraisonAI's accepted handler shape, type plus data, because that is the shape _handle_email_webhook() accepts before any signature verification.

src/praisonai/praisonai/bots/agentmail.py exposes webhook mode through AgentMailBot(mode=...) or a BotConfig whose mode is webhook. In _start_webhook_mode(), PraisonAI registers POST {webhook_path} and binds the aiohttp site to 0.0.0.0 on the configured webhook port. When config.webhook_url is set, the same method calls client.webhooks.create(url=..., event_types=["message.received"], inbox_ids=...), but it does not store or use the returned webhook secret.

The handler then trusts the parsed JSON body. _handle_email_webhook() calls await request.json(), reads body.get("type", ""), and if the value is message.received, schedules _process_webhook_payload(body) and returns 200 OK. It does not read the raw body, inspect request headers, verify svix-id, verify svix-timestamp, verify svix-signature, or check any webhook secret before scheduling the event.

_process_webhook_payload() builds a BotMessage from attacker-controlled JSON fields: data.message_id, data.from/data.from_, data.subject, data.extracted_text/data.text, data.thread_id, and data.in_reply_to. It then calls _handle_message(message). _handle_message() fires message hooks, calls self._session.chat(self._agent, sender_id, body, ...), and, when the agent returns a response, attempts to reply to the attacker-controlled sender address through AgentMail.

This report is scoped to AgentMail webhook mode. It does not claim that the default polling path or WebSocket path is affected. The WebSocket path receives typed MessageReceivedEvent instances from the AgentMail SDK connection; the webhook path exposes a public HTTP receiver and therefore needs an independent signature check before parsing/trusting the event.

PoV

the PoV calls the webhook handler directly with fake request objects. It does not bind a port, contact AgentMail, send email, or use live credentials.

The forged JSON uses PraisonAI's accepted webhook-handler shape: a top-level type field with value message.received and a nested data object. This is not presented as the canonical signed AgentMail payload shape; AgentMail's verification documentation shows verified messages using event_type after Svix verification. The issue is that PraisonAI accepts the unauthenticated type/data body and dispatches it before verifying that the request came from AgentMail.

Essential PoV excerpt:

class FakeRequest:
    def __init__(self, body, headers=None, json_error=False):
        self._body = body
        self.headers = headers or {}
        self._json_error = json_error

    async def json(self):
        if self._json_error:
            raise ValueError("invalid json")
        return self._body

bot = AgentMailBot(
    token="am_local_test",
    agent=object(),
    inbox_id="[email protected]",
    config=BotConfig(mode="webhook", webhook_path="/webhook"),
)
bot._inbox_id = "[email protected]"…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7c92-x8vg-4258. This link is maintained to preserve external references.

Original Description

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

Summary

praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches the forged message into the configured agent session and reply path.

Technical Details

The affected boundary is webhook authenticity. AgentMail's webhook verification documentation says AgentMail delivers webhooks through Svix and includes svix-id, svix-timestamp, and svix-signature headers. Receivers are expected to verify the raw request body with the endpoint signing secret, commonly stored as AGENTMAIL_WEBHOOK_SECRET, before trusting the event body. AgentMail's documented verified payload examples route on event_type; the forged payload below intentionally uses PraisonAI's accepted handler shape, type plus data, because that is the shape _handle_email_webhook() accepts before any signature verification.

src/praisonai/praisonai/bots/agentmail.py exposes webhook mode through AgentMailBot(mode=...) or a BotConfig whose mode is webhook. In _start_webhook_mode(), PraisonAI registers POST {webhook_path} and binds the aiohttp site to 0.0.0.0 on the configured webhook port. When config.webhook_url is set, the same method calls client.webhooks.create(url=..., event_types=["message.received"], inbox_ids=...), but it does not store or use the returned webhook secret.

The handler then trusts the parsed JSON body. _handle_email_webhook() calls await request.json(), reads body.get("type", ""), and if the value is message.received, schedules _process_webhook_payload(body) and returns 200 OK. It does not read the raw body, inspect request headers, verify svix-id, verify svix-timestamp, verify svix-signature, or check any webhook secret before scheduling the event.

_process_webhook_payload() builds a BotMessage from attacker-controlled JSON fields: data.message_id, data.from/data.from_, data.subject, data.extracted_text/data.text, data.thread_id, and data.in_reply_to. It then calls _handle_message(message). _handle_message() fires message hooks, calls self._session.chat(self._agent, sender_id, body, ...), and, when the agent returns a response, attempts to reply to the attacker-controlled sender address through AgentMail.

This report is scoped to AgentMail webhook mode. It does not claim that the default polling path or WebSocket path is affected. The WebSocket path receives typed MessageReceivedEvent instances from the AgentMail SDK connection; the webhook path exposes a public HTTP receiver and therefore needs an independent signature check before parsing/trusting the event.

PoV

the PoV calls the webhook handler directly with fake request objects. It does not bind a port, contact AgentMail, send email, or use live credentials.

The forged JSON uses PraisonAI's accepted webhook-handler shape: a top-level type field with value message.received and a nested data object. This is not presented as the canonical signed AgentMail payload shape; AgentMail's verification documentation shows verified messages using event_type after Svix verification. The issue is that PraisonAI accepts the unauthenticated type/data body and dispatches it before verifying that the request came from AgentMail.

Essential PoV excerpt:

class FakeRequest:
    def __init__(self, body, headers=None, json_error=False):
        self._body = body
        self.headers = headers or {}
        self._json_error = json_error

    async def json(self):
        if self._json_error:
            raise ValueError("invalid json")
        return self._body

bot = AgentMailBot(
    token="am_local_test",
    agent=object(),
    inbox_id="[email protected]",
    config=BotConfig(mode="webhook", webhook_path="/webhook"),
)
bot._inbox_id = "[email protected]"…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7c92-x8vg-4258. This link is maintained to preserve external references.

Original Description

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

Summary

praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches the forged message into the configured agent session and reply path.

Technical Details

The affected boundary is webhook authenticity. AgentMail's webhook verification documentation says AgentMail delivers webhooks through Svix and includes svix-id, svix-timestamp, and svix-signature headers. Receivers are expected to verify the raw request body with the endpoint signing secret, commonly stored as AGENTMAIL_WEBHOOK_SECRET, before trusting the event body. AgentMail's documented verified payload examples route on event_type; the forged payload below intentionally uses PraisonAI's accepted handler shape, type plus data, because that is the shape _handle_email_webhook() accepts before any signature verification.

src/praisonai/praisonai/bots/agentmail.py exposes webhook mode through AgentMailBot(mode=...) or a BotConfig whose mode is webhook. In _start_webhook_mode(), PraisonAI registers POST {webhook_path} and binds the aiohttp site to 0.0.0.0 on the configured webhook port. When config.webhook_url is set, the same method calls client.webhooks.create(url=..., event_types=["message.received"], inbox_ids=...), but it does not store or use the returned webhook secret.

The handler then trusts the parsed JSON body. _handle_email_webhook() calls await request.json(), reads body.get("type", ""), and if the value is message.received, schedules _process_webhook_payload(body) and returns 200 OK. It does not read the raw body, inspect request headers, verify svix-id, verify svix-timestamp, verify svix-signature, or check any webhook secret before scheduling the event.

_process_webhook_payload() builds a BotMessage from attacker-controlled JSON fields: data.message_id, data.from/data.from_, data.subject, data.extracted_text/data.text, data.thread_id, and data.in_reply_to. It then calls _handle_message(message). _handle_message() fires message hooks, calls self._session.chat(self._agent, sender_id, body, ...), and, when the agent returns a response, attempts to reply to the attacker-controlled sender address through AgentMail.

This report is scoped to AgentMail webhook mode. It does not claim that the default polling path or WebSocket path is affected. The WebSocket path receives typed MessageReceivedEvent instances from the AgentMail SDK connection; the webhook path exposes a public HTTP receiver and therefore needs an independent signature check before parsing/trusting the event.

PoV

the PoV calls the webhook handler directly with fake request objects. It does not bind a port, contact AgentMail, send email, or use live credentials.

The forged JSON uses PraisonAI's accepted webhook-handler shape: a top-level type field with value message.received and a nested data object. This is not presented as the canonical signed AgentMail payload shape; AgentMail's verification documentation shows verified messages using event_type after Svix verification. The issue is that PraisonAI accepts the unauthenticated type/data body and dispatches it before verifying that the request came from AgentMail.

Essential PoV excerpt:

class FakeRequest:
    def __init__(self, body, headers=None, json_error=False):
        self._body = body
        self.headers = headers or {}
        self._json_error = json_error

    async def json(self):
        if self._json_error:
            raise ValueError("invalid json")
        return self._body

bot = AgentMailBot(
    token="am_local_test",
    agent=object(),
    inbox_id="[email protected]",
    config=BotConfig(mode="webhook", webhook_path="/webhook"),
)
bot._inbox_id = "[email protected]"…