Which versions of PraisonAI are affected by CVE-2026-60090?

PraisonAI versions before 4.6.78 contain a critical SQL/CQL injection vulnerability in their knowledge-store backend that could allow unauthorized database command execution, including data…. A patch is available.

How to fix or mitigate CVE-2026-60090?

Within 24 hours: Identify all systems running PraisonAI versions prior to 4.6.78 and assess whether knowledge-store collection creation is accessible from untrusted networks or without authentication controls. Within 7 days: Upgrade all affected instances to PraisonAI 4.6.78 or later and validate deployment stability across PGVector and Cassandra backends. Within 30 days: Audit knowledge-store database logs for any anomalous DDL or administrative commands during the pre-patch window; restrict access controls on collection creation functions to authorized principals only.

PraisonAI CVE-2026-60090

Q: What is the CVSS score of CVE-2026-60090?

CVE-2026-60090 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43175 CRITICAL

SQL Injection (CWE-89)

2026-07-11 VulnCheck

GHSA-q65p-7p84-495c

SQLi Praisonai Mervinpraison

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

SQL/CQL injection yields full DB read/write/destroy (C/I/A:H); PR:L because a caller must be able to invoke create_collection with a controllable dimension rather than fully anonymous access.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 14:03 vuln.today

DescriptionCVE.org

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenant_secrets; --' to inject SQL/CQL tokens into the statement executed by the database driver.

AnalysisAI

SQL/CQL injection in PraisonAI's PGVector and Cassandra knowledge-store backends before 4.6.78 allows a caller who controls the create_collection() dimension argument to inject arbitrary database tokens. Although the code validates schema, keyspace, and collection-name identifiers, the dimension value - typed as int but never enforced at runtime - is string-interpolated directly into the vector column of the generated CREATE TABLE DDL, so a payload like '3); DROP TABLE tenant_secrets; --' executes against the backing database. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and a vendor patch is available.

Technical ContextAI

PraisonAI is a Python multi-agent / agentic-AI orchestration framework that ships pluggable knowledge-store (vector memory) backends. The vulnerable code paths are the create_collection() implementations for the PGVector (PostgreSQL + pgvector extension) and Cassandra/CQL backends, which build a CREATE TABLE statement declaring a vector-typed column whose dimensionality is set from the caller-supplied dimension parameter. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) instance caused by trusting a language-level type hint (int) instead of enforcing/parameterizing the value at runtime - because DDL column definitions and vector dimensions cannot be bound as ordinary query parameters, the developer fell back to string interpolation and validated only the identifier fields, leaving the numeric-looking dimension as an unfiltered injection sink. The affected component is cpe:2.3:a:mervinpraison:praisonai across all versions prior to 4.6.78.

RemediationAI

Vendor-released patch: upgrade PraisonAI to version 4.6.78 or later, which is the primary and recommended fix (patch commit https://github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab; advisory https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wf65-4jjx-q444). If you cannot upgrade immediately, ensure the dimension argument passed to create_collection() is never derived from untrusted input: enforce strict server-side validation by casting/coercing the value to a bounded positive integer (e.g. reject anything that is not int() within an expected range) before it reaches the DDL, which closes the injection at the call site with negligible functional side effects. Additionally, run the PGVector/Cassandra backend under a least-privilege database role that lacks DROP/DDL rights on unrelated tables so an injected statement cannot destroy tenant data - the trade-off is that legitimate collection creation must be performed under a separate privileged migration path. Avoid exposing knowledge-store collection creation directly to end users.