This vulnerability in agenticmail's @agenticmail/api and @agenticmail/core components involves improper input validation (CWE-20) and related weaknesses including SQL injection risks (CWE-89), authorization issues (CWE-284), information exposure (CWE-319), and hardcoded secrets (CWE-798). The affected versions prior to 0.9.32 (@agenticmail/api) and 0.9.10 (@agenticmail/core) had issues with inactive-agent hour filtering, SQL identifier validation, metadata ownership enforcement, blocking direct raw SQL metadata access, fail-closed handling of outbound worker secrets, SMTP envelope and header control-character validation, and default TLS certificate verification with an opt-out for local development. These issues have been addressed in the patched versions.

The vulnerability allows attackers to exploit improper input validation and related weaknesses, potentially leading to integrity violations such as unauthorized data modification or injection attacks, and limited availability impact (partial denial of service). Confidentiality impact is not indicated. There are no known exploits in the wild at this time.

The vulnerability has been patched in @agenticmail/api version 0.9.32 and @agenticmail/core version 0.9.10. Users should upgrade to these or later versions to remediate the issue. No additional mitigation guidance is provided or required beyond applying these official fixes.