Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via update_thread. When the application loads the thread list, the injected payload executes and grants full database access. This issue has been patched in version 4.5.90.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-02 | 1 | Disclosure1 |
| 2026-04-03 | 1 | Patch1 |
| 2026-04-04 | 1 | Disclosure1 |
[CVE-2026-34934: CRITICAL] Vulnerable function in PraisonAI system allowed SQL injection through unescaped thread IDs. Patch released in version 4.5.90 to fix the security issue. #cybersecurity#cve,CVE-2026-34934,#cybersecurity https://cvefind.com/CVE-2026-34934
Post summary
A critical SQL injection flaw (CVE-2026-34934) in PraisonAI is disclosed, with a patch released in version 4.5.90 to address the vulnerability.
🔴 CVE-2026-34934 - Critical PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the d... https://www.thehackerwire.com/vulnerability/CVE-2026-34934/ https://t.co/CTwG9NUdhp
Post summary
The post announces a critical SQL injection flaw in PraisonAI's get_all_user_threads function before version 4.5.90, damaging raw SQL construction via unescaped thread IDs; no exploitation code or patch information is provided.
A critical second-order SQL injection (CVE-2026-34934) affects `PraisonAI` in `get_all_user_threads`. This could lead to data compromise. Monitor for vendor patch availability. #PraisonAI #SQLi #infosec https://www.pulsepatch.io/posts/cve-2026-34934-praisonai-second-order-sql-injection
Post summary
The post reports a critical second‑order SQL injection in PraisonAI's `get_all_user_threads`, highlighting possible data compromise and advising users to monitor for vendor patch availability.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | praison | praisonai | - | - | - |