PT-2026-29821 · Praisonai · Praisonai

Yerang30 · Published 2026-04-01 · Updated 2026-04-04 · CVE-2026-34934

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI (affected versions not specified)

Description A second-order SQL injection issue exists in the get all user threads function. The function constructs raw SQL queries using f-strings with unescaped thread IDs obtained from the database. An attacker can inject a malicious thread ID via the update thread function. When the application retrieves the thread list, the injected payload is executed, potentially granting full database access. The vulnerable code is located in src/praisonai/praisonai/ui/sql alchemy.py. The attack flow involves inserting a malicious payload through update thread (line 539), constructing a thread ID string (line 547), and then using this string in a SQL query (line 576). This could lead to the exfiltration of sensitive data, access to conversation histories, and the ability to modify or delete database contents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-34934

GHSA-9CQ8-3V94-434G

Affected Products

Praisonai

References · 7

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cq8-3v94-434g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34934 · Security Note
• https://osv.dev/vulnerability/GHSA-9cq8-3v94-434g · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI · Note
• https://twitter.com/TheHackerWire/status/2040278200190988456 · Twitter Post
• https://twitter.com/CveFindCom/status/2040213740537123060 · Twitter Post
• https://twitter.com/pulsepatchio/status/2039720191672905950 · Twitter Post