Skip to content
Threat Feed
Subscribe

Tag

Cql-Injection

1 brief RSS
critical advisory

PraisonAI SQL/CQL Injection via Unvalidated PGVector/Cassandra Dimension (CVE-2026-60090)

PraisonAI versions before 4.6.78 are vulnerable to SQL/CQL injection, allowing an attacker to inject malicious SQL/CQL tokens into generated CREATE TABLE DDL statements by influencing the unvalidated 'dimension' argument in PGVector and Cassandra knowledge-store backends, potentially leading to arbitrary database command execution and data manipulation or destruction.

PraisonAI before 4.6.78 sql-injection cql-injection data-destruction praisonai database-vulnerability
2t 1c