CVE-2026-60090

PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension

View on CVE.org
Published Jul 11, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenant_secrets; --' to inject SQL/CQL tokens into the statement executed by the database driver.

Analysis

AI-generated

Technical impact

PraisonAI before version 4.6.78 fails to validate the dimension argument used when creating collections in its PGVector and Cassandra back‑ends. The dimension is declared as an integer but is not enforced at runtime, so the value is directly interpolated into the CREATE influence the dimension can supply a string like "3); DROP TABLE tenant_secrets; --" and inject SQL or CQL commands into the statement executed by the database driver, enabling the execution of destructive data manipulation.

Affected Systems

The flaw affects MervinPraison’s PraisonAI application in all releases earlier running these versions is at risk regardless of its underlying operating system.

Risk and Exploitability

The CVSS score of 9.3 classifies this as a critical vulnerability. The EPSS score of <1% indicates a very low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, is acreation requests parameter, he or she can inject arbitrary SQL or CQL, potentially causing data loss or compromise of the database integrity.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to PraisonAI 4.6.78 or later to enforce proper dimension validation
  • Limit collection‑creation operations to prevent attackers from influencing dimension parameters
  • Audit database logs for evidence of injected commands
  • Restore affected collections from backups if tampering is detected

Generated by OpenCVE AI on August 1, 2026 at 11:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-wf65-4jjx-q444 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mervinpraison
Mervinpraison praisonai
Vendors & Products Mervinpraison
Mervinpraison praisonai
Type Values Removed Values Added
Description PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenant_secrets; --' to inject SQL/CQL tokens into the statement executed by the database driver.
Title PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension
First Time appeared Praison
Praison praisonai
Weaknesses CWE-89
CPEs cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*
Vendors & Products Praison
Praison praisonai
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Jul 14, 2026, 2:34 PM
Reserved
Jul 8, 2026, 12:14 PM

View source JSON

Updated
Jul 14, 2026, 2:09 PM

JSON

Status
Deferred
Published
Jul 11, 2026, 2:16 PM
Modified
Jul 14, 2026, 3:17 PM

View source JSON

No data.

Updated
Aug 1, 2026, 11:30 AM

JSON