PraisonAI: SQL Injection via unvalidated table_prefix in 9 conversation store backends (incomplete fix for CVE-2026-40315)

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

• CVE-2026-41496: 0.35% estimated exploitation activity in the next 30 days; percentile 28.36 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation. 52 unvalidated injection points across the codebase. postgres.py additionally accepts an unvalidated schema parameter used directly in DDL. Severity High — CWE-89 (SQL Injection) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N — 8.1 Exploitable in any deployment where tableprefix is derived from external input (multi-tenant setups, API-driven configuration, user-modifiable config files). Default config ("praison") is not affected. Details The CVE-2026-40315 fix added this guard to sqlite.py:52: The following backends perform the identical tableprefix → f-string SQL pattern without this guard: | Backend | File | Line | Injection points | | ---------------- |…

Published by the source

17 Apr 2026, 22:24 UTC

Last modified by the source

13 Jul 2026, 16:42 UTC

Source last checked

26 Oct 2026, 13:41 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-rg3h-x3jw-7jm5

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-rg3h-x3jw-7jm5

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-41496

Advisory: PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
IDs: CVE-2026-41496, GHSA-rg3h-x3jw-7jm5
Record: https://patchnext.com/advisories/cve-2026-41496 (revision 2, source checked 26 Oct 2026, 13:41 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: praisonaiagents 1.6.8; praisonai 4.5.149. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI praisonaiagents: affected <= 1.6.7; fixed in 1.6.8
- PyPI praisonai: affected <= 4.5.148; fixed in 4.5.149

## Suggested inspection (read-only)
- `python -m pip show praisonaiagents`: prints the installed version. Run with the environment that serves production active.
- `python -m pip show praisonai`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on praisonaiagents, praisonai.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-rg3h-x3jw-7jm5 (OSV record GHSA-rg3h-x3jw-7jm5 lists affected ranges: PyPI praisonai >=0 =0 <1.6.8 (fixed))
- Verified: https://github.com/advisories/GHSA-rg3h-x3jw-7jm5 (GitHub-reviewed advisory GHSA-rg3h-x3jw-7jm5 lists affected ranges: PyPI praisonai >=0 =0 <=1.6.7)

Commands are suggestions: review each one before running it.