AgenticMail vulnerabilities

Vulnerability in AgenticMail packages (@agenticmail/claudecode before 0.2.39, @agenticmail/codex before 0.1.33, @agenticmail/core before 0.9.43, @agenticmail/openclaw before 0.5.71). An external email sent to the bridge inbox causes the operator's Claude Code session to resume with bypassed permissions, enabling indirect prompt injection into a fully-privileged agent.

Vulnerability in AgenticMail (versions before 0.9.64) allows a low-privileged authenticated agent to enumerate and claim tasks assigned to other agents. Missing authorization in task endpoints.

Multiple weaknesses in AgenticMail before versions 0.9.32 (API) and 0.9.10 (core), related to validation, binding, inactive-agent hour filtering, SQL identifier validation, metadata ownership checks, blocking direct metadata access via raw SQL, outbound worker secret handling, SMTP control character validation, and TLS certificate verification.