What is the CVSS score of CVE-2026-44337?

CVE-2026-44337 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-44337?

Yes, a patch is available for CVE-2026-44337. Update the affected software to the latest version immediately.

PraisonAI CVE-2026-44337

EUVD-2026-28640 MEDIUM

Improper Input Validation (CWE-20)

2026-05-08 security-advisories@github.com

GHSA-3643-7v76-5cj2

Code Injection Praisonai Praison

6.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 08, 2026 - 15:17 EUVD

Analysis Generated

May 08, 2026 - 15:01 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

MEDIUM 6.3

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. This issue has been patched in version 4.6.34.

AnalysisAI

SQL and CQL injection vulnerability in PraisonAI multi-agent teams system versions 2.4.1 through 4.6.33 allows authenticated attackers to execute arbitrary SQL or CQL commands by injecting malicious collection names into knowledge-store implementations. The vulnerability affects applications that pass untrusted collection names to optional SQL/CQL-backed storage backends, enabling data exfiltration, modification, or deletion with low complexity exploitation.

Technical ContextAI

PraisonAI implements optional knowledge-store backends using SQL and CQL (Cassandra Query Language) databases. These backends construct table and index identifiers by concatenating user-supplied name and collection arguments without proper input validation or parameterized queries. The root cause is improper input validation (CWE-20) of collection names before they are incorporated into dynamic SQL/CQL statement construction, allowing attackers to break out of the intended identifier context and inject arbitrary SQL or CQL syntax. This affects the SQL and CQL storage implementations specifically, not the default in-memory or document-based stores.

RemediationAI

Upgrade PraisonAI to version 4.6.34 or later, which patches the vulnerability by validating and properly handling collection name inputs. Organizations unable to immediately upgrade should disable SQL/CQL-backed knowledge stores and use alternative storage backends (in-memory or document-based) until patching is feasible. As a compensating control, restrict collection name inputs to allowlisted values containing only alphanumeric characters and underscores, enforced at the application layer before passing to PraisonAI APIs - this mitigates injection but reduces flexibility and requires code changes. Additionally, enforce least-privilege database access at the database level, ensuring PraisonAI's database user has minimal required permissions (e.g., read-only if knowledge-store is read-only), which limits damage from successful SQL injection. See https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3643-7v76-5cj2 for patch confirmation.