EUVD-2026-22215Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vulnerability in SQLiteConversationStore where the table_prefix configuration value is directly concatenated into SQL queries via f-strings without any validation or sanitization. Since SQL identifiers cannot be safely parameterized, an attacker who controls the table_prefix value (e.g., through from_yaml or from_dict configuration input) can inject arbitrary SQL fragments that alter query structure. This enables unauthorized data access, such as reading internal SQLite tables like sqlite_master, and manipulation of query results through techniques like UNION-based injection. The vulnerability propagates from configuration input in config.py, through factory.py, to the SQL query construction in sqlite.py. Exploitation requires the ability to influence configuration input, and successful exploitation leads to internal schema disclosure and full query result tampering. This issue has been fixed in version 4.5.133.
AnalysisAI
SQL identifier injection in PraisonAI's SQLiteConversationStore allows authenticated local attackers with configuration control to extract database schema and manipulate query results. The vulnerability affects PraisonAI versions prior to 4.5.133, where unsanitized table_prefix values are concatenated into SQL queries via f-strings. Attackers controlling configuration inputs (from_yaml/from_dict) can inject SQL fragments to access internal SQLite tables like sqlite_master and execute UNION-based injections. A vendor patch is available in version 4.5.133. No public exploit code or active exploitation confirmed at time of analysis. CVSS 7.2 indicates local attack vector with low complexity but requires low privileges and present attack complexity conditions.
Technical ContextAI
The vulnerability exists in PraisonAI's SQLiteConversationStore component (cpe:2.3:a:mervinpraison:praisonai), specifically in the sqlite.py module where SQL query construction occurs. This is a classic SQL identifier injection (CWE-89) issue arising from the inability to safely parameterize SQL identifiers (table/column names) using prepared statements. The table_prefix configuration parameter flows through the application's configuration pipeline (config.py → factory.py → sqlite.py) and is directly embedded into SQL queries using Python f-string formatting. Unlike SQL value injection where parameterized queries provide protection, identifier injection requires explicit validation or allowlisting since database APIs do not support parameterized identifiers. The multi-agent teams system architecture means this configuration injection point affects the conversation storage layer, which likely handles sensitive agent interaction data. SQLite's sqlite_master table, accessible through this vulnerability, contains complete schema information for all database objects.
RemediationAI
Upgrade to PraisonAI version 4.5.133 or later, which contains the fix implemented in commit 0accebb2e3c3ec2fca66bbea0444fb7a35f0b4ef (available at https://github.com/MervinPraison/PraisonAI/commit/0accebb2e3c3ec2fca66bbea0444fb7a35f0b4ef). For environments where immediate upgrade is not feasible, implement strict input validation on table_prefix configuration values using an allowlist of alphanumeric characters only, rejecting any special characters or SQL syntax. Alternatively, restrict configuration input methods (from_yaml/from_dict) to trusted sources only and remove user-controllable configuration capabilities. Review existing configurations for suspicious table_prefix values and audit SQLite database contents for unauthorized schema modifications. Consult the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x783-xp3g-mqhp for additional vendor guidance.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today