{"action":"Upgrade @agenticmail/api to 0.9.64 or later.","affected":[{"fixed":"0.9.64","introduced":"0"}],"component":"@agenticmail/api","cve_ids":["CVE-2026-57494"],"ecosystem":"npm","epss":0.00273,"exploited":false,"fixed_versions":["0.9.64"],"ghsa_id":"GHSA-hjwc-26pj-v3pm","id":"tcs_01M5KFVDJQTNXG0MFBF0ET5DMC","modified_at":"2026-07-20T22:26:45.921845Z","published_at":"2026-06-18T17:20:55Z","references":["https://osv.dev/vulnerability/GHSA-hjwc-26pj-v3pm","https://github.com/agenticmail/agenticmail/security/advisories/GHSA-hjwc-26pj-v3pm","https://github.com/agenticmail/agenticmail"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-hjwc-26pj-v3pm","url":"https://osv.dev/vulnerability/GHSA-hjwc-26pj-v3pm"}],"summary":"AgenticMail: Cross-agent task authorization bypass in AgenticMail API"}