Praisonai CVE-2026-40315

Attacker must have low-privilege local access to PraisonAI instances running versions prior to 4.5.133 and control the table_prefix configuration value through from_yaml or from_dict configuration inputs to inject SQL fragments into SQLiteConversationStore queries.

The CVSS 7.2 score reflects meaningful constraints that reduce real-world exploitability. The local attack vector (AV:L) requires the attacker to already have access to the system where PraisonAI runs, and low privileges (PR:L) means authenticated access is required. The attack complexity present (AT:P) indicator suggests specific conditions must be met-specifically, the attacker must control configuration input through from_yaml or from_dict methods, which may not be exposed in all deployment scenarios. High confidentiality and integrity impacts (VC:H/VI:H) with no availability impact (VA:N) indicate data exfiltration and tampering risks without service disruption. No EPSS score is available, and KEV status shows no active exploitation, suggesting this remains a theoretical risk. The absence of publicly available exploit code further reduces immediate weaponization risk. SSVC assessment: exploitation status is none, technical impact is partial (data access/manipulation but no code execution), and automatability is low due to configuration control prerequisite. This is a genuine risk for multi-tenant or configuration-as-code deployments where untrusted users can supply YAML/dict configurations, but lower priority for single-tenant installations with trusted configuration sources.

An attacker with authenticated local access to a PraisonAI deployment gains the ability to supply configuration data through YAML files or dictionary inputs. By crafting a malicious table_prefix value containing SQL fragments like "conversations" UNION SELECT type,name,sql,1,2 FROM sqlite_master--, the attacker injects commands into the query construction logic. When SQLiteConversationStore executes queries with this poisoned prefix, it returns internal schema information from sqlite_master, exposing all database table structures, column names, and stored data relationships, enabling subsequent targeted data extraction attacks.