PraisonAI’s conversation stores allow attackers to inject arbitrary SQL through the unvalidated table_prefix parameter, as well as an unvalidated schema parameter in the PostgreSQL backend. The flaw exists in nine different database backends, providing 52 injection points across the codebase. An attacker who supplies malicious input can alter query logic, read sensitive data, or possibly execute arbitrary commands within the database context, compromising confidentiality, integrity, and potentially leading to system compromise.

The vulnerability affects MervinPraison’s PraisonAI, specifically versions prior to 4.6.9 for the core system and prior to 1.6.9 for the agent component. It impacts all supported backends, including MySQL, PostgreSQL, async SQLite, Turso, SingleStore, Supabase, SurrealDB, and others that use the table_prefix input without proper validation.

With a CVSS score of 8.1, the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is through any interface that accepts a table_prefix or schema parameter, likely via an exposed API or administrative configuration. Exploitation requires insertion of SQL syntax into these parameters, which then gets embedded directly into f-string SQL statements.