Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vulnerability in SQLiteConversationStore where the table_prefix configuration value is directly concatenated into SQL queries via f-strings without any validation or sanitization. Since SQL identifiers cannot be safely parameterized, an attacker who controls the table_prefix value (e.g., through from_yaml or from_dict configuration input) can inject arbitrary SQL fragments that alter query structure. This enables unauthorized data access, such as reading internal SQLite tables like sqlite_master, and manipulation of query results through techniques like UNION-based injection. The vulnerability propagates from configuration input in config.py, through factory.py, to the SQL query construction in sqlite.py. Exploitation requires the ability to influence configuration input, and successful exploitation leads to internal schema disclosure and full query result tampering. This issue has been fixed in version 4.5.133.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-14 | 2 | Disclosure2 |
| 2026-04-15 | 1 | Disclovery1 |
| 2026-04-18 | 1 | Disclosure1 |
| 2026-05-09 | 1 | General1 |
CVE-2026-41496 PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLi… https://www.cve.org/CVERecord?id=CVE-2026-41496
Post summary
The text only references CVE-2026-41496 and links to its CVE record, with no further details on exploitation, patching, or vulnerability specifics.
🔴 PraisonAI, SQL Injection, #CVE-2026-40315 (High) https://dailycve.com/praisonai-sql-injection-cve-2026-40315-high/
Post summary
The post announces a new high‑severity SQL injection vulnerability (CVE‑2026‑40315) in PraisonAI, directing readers to a dailycve.com report for more details.
⚡ New CVE Alert: CVE-2026-40315 📊 Severity: 7.2 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-40315 #CVE-2026-40315 #CVE #High #CyberSecurity #InfoSec https://t.co/EH2yaIhAZb
Post summary
The tweet announces CVE‑2026‑40315 with a severity of 7.2, indicating high risk, but provides no additional technical details or mitigation advice.
CVE-2026-40315 PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vulnerability in SQLiteConversationStore where the table_prefix config… https://www.cve.org/CVERecord?id=CVE-2026-40315
Post summary
The post announces that PraisonAI versions before 4.5.133 contain an SQL identifier injection vulnerability in SQLiteConversationStore linked to the table_prefix configuration.
CVE-2026-40315 SQL Identifier Injection in PraisonAI SQLiteConversationStore Prior to 4.5.133 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40315
Post summary
The CVE details a SQL Identifier Injection in PraisonAI SQLiteConversationStore version prior to 4.5.133.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | praison | praisonai | - | - | - |