Executive brief
PraisonAI is a framework for building AI agents. Its data storage components for PostgreSQL, Cassandra, and SingleStore are vulnerable to injection attacks because they do not properly check database table names provided by users. An attacker could potentially use this to delete data, access unauthorized information, or disrupt the application's database operations.
Technical details
The vulnerability exists in the KnowledgeStore interface and its specific implementations for pgvector, Cassandra, and SingleStoreVector. The root cause is the direct interpolation of 'name' and 'collection' arguments into raw SQL/CQL query strings (e.g., CREATE TABLE, DROP TABLE, INSERT) without validation or parameterized quoting. While PraisonAI has an internal 'validate_identifier' function, it was not applied to these specific knowledge-store backends. An attacker who can influence collection names passed to these persistence APIs can execute arbitrary database commands. The issue was patched in version 4.6.34.
Affected products
- MervinPraison PraisonAI >= 2.4.1, <= 4.6.33
Timeline
- 2026-05-01: other: Vulnerability confirmed present in version 4.6.33
- 2026-05-03: advisory: GitHub Advisory published
- 2026-05-11: disclosed: CVE-2026-44337 disclosed
- 2026-05-03: patched: Fixed in version 4.6.34