CVE-2026-47255

{"id": "CVE-2026-47255", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47255", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T14:06:17.607188Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "agenticmail", "product": "@agenticmail/api", "versions": [{"status": "affected", "version": "< 0.9.32"}]}, {"vendor": "agenticmail", "product": "@agenticmail/core", "versions": [{"status": "affected", "version": "< 0.9.10"}]}]}], "published": "2026-07-20T22:17:15.403", "references": [{"url": "https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/CHANGELOG.md?plain=1#L1842", "source": "security-advisories@github.com"}, {"url": "https://github.com/agenticmail/agenticmail/blob/7b9b05d973676e9f3d097c08b8e649f59bfc15d0/packages/core/src/mail/sender.ts#L33", "source": "security-advisories@github.com"}, {"url": "https://github.com/agenticmail/agenticmail/commit/1408de543fa3577d8c2d4fdb289c75fe6faafac7", "source": "security-advisories@github.com"}, {"url": "https://github.com/agenticmail/agenticmail/commit/234b811e426a0743170f3b10bc43419d64330155", "source": "security-advisories@github.com"}, {"url": "https://github.com/agenticmail/agenticmail/commit/6c70c8254c906f823392d7f5ccee88a5481e7731", "source": "security-advisories@github.com"}, {"url": "https://github.com/agenticmail/agenticmail/commit/8cb053f2307dd77b7736ffa0d7df04b0ccc3272d", "source": "security-advisories@github.com"}, {"url": "https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-319"}, {"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched."}], "lastModified": "2026-07-21T15:16:35.860", "sourceIdentifier": "security-advisories@github.com"}