Executive brief
PraisonAI, a framework for managing AI agents, contains a vulnerability in how it handles database configuration. An attacker who can influence the application's configuration settings can execute unauthorized database commands. This could lead to the exposure of internal system information or the manipulation of data used by the AI agents.
Technical details
A SQL injection vulnerability exists in PraisonAI's SQLiteConversationStore due to improper neutralization of the 'table_prefix' configuration value. The software uses Python f-strings to concatenate this prefix directly into SQL table identifiers, which cannot be safely parameterized in standard SQL queries. An attacker capable of providing a malicious configuration (via YAML or dictionary input) can inject arbitrary SQL fragments, such as UNION SELECT statements. This allows for unauthorized access to internal SQLite metadata tables (like sqlite_master) and the ability to tamper with query results. The issue is fixed in version 4.5.133.
Affected products
- MervinPraison PraisonAI < 4.5.133
Timeline
- 2026-04-09: patched: Version 4.5.133 released
- 2026-04-10: advisory: GitHub Advisory published
- 2026-04-14: other: NVD publication date