Executive brief
PraisonAI, a system for managing multi-agent AI teams, is vulnerable to a security flaw that allows attackers to gain full access to its database. By submitting a specially crafted thread ID, an attacker can trick the system into executing unauthorized database commands. This could lead to the theft of sensitive user data, API keys, and conversation histories, or the total deletion of the database.
Technical details
A second-order SQL injection vulnerability exists in PraisonAI's SQLAlchemy data layer. The 'get_all_user_threads' function in 'src/praisonai/praisonai/ui/sql_alchemy.py' constructs raw SQL queries using Python f-strings to include thread IDs previously stored in the database. An attacker can first call 'update_thread' to store a malicious SQL payload as a 'thread_id'. When 'get_all_user_threads' is subsequently called, the unescaped payload is concatenated into an 'IN' clause, allowing for arbitrary SQL execution. This can result in full database exfiltration or modification. The vulnerability is resolved in version 4.5.90 by properly parameterizing queries.
Affected products
- MervinPraison PraisonAI < 4.5.90
Timeline
- 2026-03-31: advisory: Vendor advisory published on GitHub
- 2026-04-03: disclosed: CVE published to NVD
- 2026-04-03: patched: Fix released in version 4.5.90