CVE-2026-60090: PraisonAI SQL Injection Vulnerability

CVE-2026-60090 Overview

CVE-2026-60090 is a SQL and CQL injection vulnerability in PraisonAI versions before 4.6.78. The flaw resides in the create_collection() backends for the PGVector and Cassandra knowledge stores. While schema, keyspace, and collection-name identifiers are validated, the dimension argument is declared as int but never enforced at runtime. The value is interpolated directly into the vector column of the generated CREATE TABLE Data Definition Language (DDL) statement. An attacker who can influence collection-creation dimensions can inject arbitrary SQL or CQL tokens into the statement executed by the database driver.

Critical Impact
Remote, unauthenticated attackers can inject SQL/CQL statements into database DDL, enabling data exfiltration, tampering, or destruction of tenant tables.

Affected Products

PraisonAI versions prior to 4.6.78
PraisonAI PGVector knowledge-store backend
PraisonAI Cassandra knowledge-store backend

Discovery Timeline

2026-07-11 - CVE-2026-60090 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-60090

Vulnerability Analysis

The vulnerability is a classic injection flaw [CWE-89] triggered by unvalidated interpolation of a numeric-typed argument into a database DDL string. PraisonAI's knowledge-store abstraction accepts a dimension parameter used to define the width of a vector column. Although Python type hints declare the argument as int, the runtime does not coerce or verify the value before string interpolation. This allows a caller supplying a string payload to break out of the numeric context and append arbitrary tokens to the statement.

Because the injection occurs inside a CREATE TABLE statement executed by the underlying database driver, the attacker inherits the privileges of the PraisonAI database user. In multi-tenant deployments, this typically includes read and write access to tables belonging to other tenants stored in the same schema or keyspace.

Root Cause

The root cause is missing runtime type enforcement combined with string-based query construction. PraisonAI validated the identifier arguments (schema, keyspace, collection name) but treated the dimension value as safe because of its declared type. Parameterized query APIs are not used for DDL in most database drivers, which places the burden of input sanitization on the application layer.

Attack Vector

An attacker capable of invoking create_collection() — directly through an exposed API or indirectly through an agent workflow that forwards user input — supplies a crafted dimension value such as 3); DROP TABLE tenant_secrets; --. The resulting DDL statement is executed by the PGVector or Cassandra driver, terminating the intended CREATE TABLE and appending the attacker's statements. The attack requires no authentication and no user interaction when the collection-creation endpoint is reachable over the network.

See the VulnCheck Advisory and GitHub Security Advisory GHSA-wf65-4jjx-q444 for additional technical detail.

Detection Methods for CVE-2026-60090

Indicators of Compromise

Database logs containing CREATE TABLE statements with non-numeric content in the vector column dimension position.
Unexpected DROP TABLE, ALTER TABLE, or INSERT statements executed immediately after a create_collection() call in PraisonAI application logs.
New or missing tables in PGVector schemas or Cassandra keyspaces used by PraisonAI knowledge stores.
Application errors from the database driver referencing malformed DDL following knowledge-store initialization.

Detection Strategies

Enable statement logging on PostgreSQL (log_statement = 'ddl') and audit logging in Cassandra to capture every DDL statement issued by the PraisonAI service account.
Alert on any DDL executed by the PraisonAI database role that contains multiple semicolons or SQL comment markers (--, /*).
Inspect PraisonAI application logs for calls to create_collection() where the dimension parameter is not a pure integer.

Monitoring Recommendations

Baseline the expected DDL patterns issued by PraisonAI and alert on deviations, particularly any statement affecting tables outside the target collection.
Monitor database role activity for privilege-sensitive operations such as DROP, TRUNCATE, and cross-schema reads originating from the PraisonAI user.
Correlate agent input events with subsequent database DDL execution to identify user-influenced injection attempts.

How to Mitigate CVE-2026-60090

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later, which enforces integer validation on the dimension argument.
Restrict network exposure of any API endpoint that reaches create_collection() until the patch is applied.
Rotate database credentials used by PraisonAI if injection activity is suspected in logs.
Audit PGVector schemas and Cassandra keyspaces for unauthorized table modifications.

Patch Information

The fix is delivered in PraisonAI 4.6.78 via commit 3aa9cbc2bd49c23a32be0a89a5e620d13d843eab. The patch coerces the dimension argument to an integer and rejects non-integer input before DDL construction. Refer to the GitHub Security Advisory for release notes.

Workarounds

Wrap calls to create_collection() with a strict integer cast (int(dimension)) and reject values outside expected bounds.
Run the PraisonAI database user with least-privilege permissions that forbid DROP and cross-tenant access.
Isolate each tenant into a dedicated schema or keyspace to limit blast radius if injection occurs.
Place a reverse proxy or API gateway in front of PraisonAI to filter requests containing non-numeric dimension values.

bash

# Configuration example - upgrade PraisonAI to the patched release
pip install --upgrade 'praisonai>=4.6.78'

# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"