PraisonAI's SQLiteConversationStore concatenates the table_prefix configuration directly into SQL identifiers without validation, creating an identifier injection flaw. An attacker controlling this value—through configuration files parsed by from_yaml or from_dict—can inject arbitrary SQL fragments. This allows extraction of sensitive schema information, reading internal SQLite tables such as sqlite_master, and manipulating query results via UNION-based techniques. The result is a breach of confidentiality and integrity of database data, potentially exposing internal system structures and corrupting data returned to higher‑level components.

The vulnerability exists in all releases of PraisonAI prior to version 4.5.133. It affects the MervinPraison PraisonAI product when the SQLiteConversationStore is used and when configuration inputs are provided through config.py causing table_prefix to be set from untrusted sources. Versions 4.5.133 and later have the issue fixed.

The CVSS score of 7.2 indicates a moderate to high risk. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires influence over configuration input; systems that allow user‑supplied or remotely editable configuration files are most vulnerable. If successfully exploited, an attacker gains full visibility of the database schema and can alter data returned to application components, potentially enabling further compromise.