PraisonAI implements optional SQL and CQL backends for its knowledge store. From version 2.4.1 up to just before 4.6.34, the system builds table and index identifiers directly from the collection name supplied by the application. This allows an attacker to supply an untrusted collection name that contains injected SQL or CQL code, enabling exploitation of CWE-20 and CWE-89 weaknesses. The injection can lead to unauthorized data disclosure, alteration, or destruction within the database hierarchy, impacting the confidentiality, integrity, and availability of the knowledge store.

Vendors affected: MervinPraison, product: PraisonAI. Versions vulnerable include all releases from 2.4.1 through the latest pre‑4.6.34. Products after 4.6.34 contain the fix.

The CVSS score of 6.3 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no currently known widespread exploitation. The likely attack vector requires an attacker to interact with an application that uses the SQL/CQL knowledge‑store and control the collection name parameter; therefore, the vulnerability is accessible via the application layer and may require authentication or elevated permissions to exploit fully. External exploitation would be possible if the application is exposed over a network and accepts uncontrolled collection names.