What is the CVSS score of CVE-2026-41496?

CVE-2026-41496 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PraisonAI are affected by CVE-2026-41496?

PraisonAI versions prior to 4.6.9 contain a critical SQL injection vulnerability affecting nine database backends that allows authenticated attackers to execute arbitrary SQL commands, posing a…. A patch is available.

How to fix or mitigate CVE-2026-41496?

Within 24 hours: Identify all systems running praisonai versions below 4.6.9 or praisonaiagents below 1.6.9 and verify which database backends are in use. Within 7 days: Upgrade praisonai to version 4.6.9 or later and praisonaiagents to version 1.6.9 or later across all affected instances; validate upgrades in non-production environments first. Within 30 days: Conduct access logs review for any unauthorized database query activity post-deployment, and implement input validation policies for external parameters in API configurations.

PraisonAI CVE-2026-41496

EUVD-2026-28594 HIGH

SQL Injection (CWE-89)

2026-05-08 security-advisories@github.com

GHSA-rg3h-x3jw-7jm5

PostgreSQL SQLi

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 08, 2026 - 14:31 vuln.today

Analysis Generated

May 08, 2026 - 14:31 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends - MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB - pass table_prefix straight into f-string SQL. Same root cause, same code pattern, same exploitation. 52 unvalidated injection points across the codebase. postgres.py additionally accepts an unvalidated schema parameter used directly in DDL. This issue has been patched in praisonai version 4.6.9 and praisonaiagents version 1.6.9.

AnalysisAI

SQL injection in PraisonAI's multi-backend conversation storage system allows authenticated attackers to execute arbitrary SQL commands. The incomplete fix for CVE-2026-40315 validated input only in SQLiteConversationStore, leaving nine other database backends (MySQL, PostgreSQL, Turso, SingleStore, Supabase, SurrealDB, and their async variants) vulnerable to f-string SQL injection via unvalidated table_prefix and schema parameters. 52 injection points exist across the codebase. Exploitable in multi-tenant deployments or API-driven configurations where table_prefix is derived from external input. Patches released in praisonai 4.6.9 and praisonaiagents 1.6.9 address all affected backends. EPSS and KEV data unavailable; no public POC confirmed at time of analysis.

Technical ContextAI

PraisonAI is a multi-agent AI teams system with conversation persistence backed by multiple database systems. The vulnerability stems from CWE-89 (SQL Injection) via unsafe f-string formatting in Python database connectors. The original CVE-2026-40315 fix implemented regex validation (^[a-zA-Z0-9_]*$) for table_prefix in sqlite.py:52 only. The remaining backends (mysql.py, postgres.py, async_sqlite.py, async_mysql.py, async_postgres.py, turso.py, singlestore.py, supabase.py, surrealdb.py) continued using table_prefix directly in f-string SQL DDL and DML statements without sanitization. PostgreSQL backend additionally accepts an unvalidated schema parameter at line 88. Affected packages are pip/praisonai (vulnerable <= 4.5.148) and pip/praisonaiagents (vulnerable <= 1.6.7), indicating the vulnerability exists in both the core PraisonAI framework and its standalone agents library.

RemediationAI

Upgrade immediately to praisonai version 4.6.9 or later and praisonaiagents version 1.6.9 or later via pip install --upgrade praisonai praisonaiagents. Vendor advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rg3h-x3jw-7jm5 confirms patches implement regex validation (^[a-zA-Z0-9_]*$) across all affected backends. If immediate patching is blocked, implement these SPECIFIC compensating controls: (1) Hardcode table_prefix to 'praison_' in all backend initialization code-prevents external input entirely but breaks multi-tenant table isolation; (2) Deploy web application firewall rules blocking SQL metacharacters (semicolon, dash-dash, quotes) in any API parameters mapped to storage configuration-may cause false positives with legitimate underscores in prefixes; (3) Restrict database user privileges to DML-only (revoke CREATE/DROP/ALTER)-limits injection impact to data exfiltration/modification but prevents normal table creation workflows; (4) Enable database query logging and monitor for suspicious DDL statements containing unusual table/schema names-detective control only, no prevention. Each workaround trades functionality for security; patching remains the only complete fix.