PraisonAI CVE-2026-44337

Exploitation requires: (1) PraisonAI deployed with SQL or CQL knowledge-store backends explicitly enabled and configured; (2) Authenticated user access to the application (PR:L from CVSS); (3) Application or API endpoint that accepts collection name as user input and passes it to PraisonAI knowledge-store operations without prior validation; (4) The attacker must have network access to the application (AV:N). Exploitation is NOT possible if PraisonAI uses default in-memory or document-based storage, if collection names are hardcoded and never derived from user input, or if input validation is performed at the application layer before passing to PraisonAI. Default configurations of PraisonAI may not enable SQL/CQL backends, making this low-risk for minimal deployments, but any production system accepting user-supplied collection names and using optional SQL/CQL storage is vulnerable.

CVSS 6.3 indicates moderate risk with network accessibility (AV:N), low attack complexity (AC:L), and low privileges required (PR:L), but CVSS score alone understates real-world impact because SQL/CQL injection typically enables complete database compromise. The authenticated requirement (PR:L) significantly limits attack surface compared to unauthenticated vectors - only users with application access can exploit this. However, once authenticated, exploitation is trivial and results in confidentiality, integrity, and availability impacts (CIL). EPSS data unavailable, but the simplicity of SQL injection exploitation combined with the moderate CVSS score suggests this is a real priority for organizations running PraisonAI with SQL/CQL backends and accepting untrusted collection names from users or external systems. The fact that this only affects optional backends means some deployments may be unaffected if using different storage mechanisms.

An authenticated user of a PraisonAI application submits a collection name containing SQL injection payload such as agents'; DROP TABLE agents; -- when creating or querying a knowledge store backed by a SQL database. The application passes this untrusted name to PraisonAI's SQL backend without validation. PraisonAI constructs a query like CREATE TABLE agents_agents'; DROP TABLE agents; --_idx (...) or similar, causing the injected DROP statement to execute and delete the agents table, denying service or exposing sensitive data.