CVE-2026-60090: PraisonAI SQL/CQL injection

CISO Take

PraisonAI's knowledge-store integrations for PGVector and Cassandra fail to validate the collection dimension parameter before interpolating it directly into the generated CREATE TABLE DDL, letting a caller inject arbitrary SQL or CQL tokens such as a DROP TABLE payload. This is a textbook CWE-89 injection with a CVSS 9.8 — network-reachable, no authentication or user interaction required, and full confidentiality/integrity/availability impact — in a package many teams already run as their agent orchestration layer. There's no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this hasn't been weaponized in the wild as of this writing, but the fix is a one-line-of-reasoning bug class that's trivial to reproduce once the advisory is public. Patch to PraisonAI 4.6.78 or later immediately, and until you can confirm the patched version is deployed, treat any collection-creation code path (API endpoints, agent configs, multi-tenant onboarding) that lets a user influence the dimension value as untrusted input requiring strict integer allow-listing at your application layer as a compensating control.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

Critical on paper (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) because the flaw requires no authentication, no user interaction, and low attacker skill to trigger — any code path that lets an external caller influence a collection's dimension value is directly exploitable. Real-world risk hinges on exposure: if dimension is only ever set from trusted server-side config, exploitability drops sharply; if it's exposed via an API, agent tool call, or multi-tenant self-service flow (a common pattern for RAG/knowledge-base products), it's remotely exploitable with zero prerequisites. No EPSS score, no CISA KEV listing, and no public PoC/scanner template currently reduce near-term mass-exploitation likelihood, but the vulnerability class (classic string interpolation into DDL) is easy to weaponize once researchers or attackers look at the diff between 4.6.78 and prior versions.

How does the attack unfold?

Entry point

Attacker reaches a collection-creation code path (API, agent tool call, or self-service onboarding) that lets them influence the dimension parameter passed to PraisonAI's PGVector or Cassandra backend.

AML.T0049

Injection

Attacker submits a crafted string like '3); DROP TABLE tenant_secrets; --' as the dimension value, which PraisonAI interpolates unvalidated directly into the generated CREATE TABLE DDL.

Execution

The database driver executes the tampered DDL statement as-is, running the attacker's injected SQL/CQL alongside the legitimate table creation.

AML.T0036

Impact

Depending on the injected payload and DB account privileges, the attacker drops tables, exfiltrates tenant data, or corrupts the RAG knowledge base that feeds the AI system's responses.

AML.T0025

Entry point

Attacker reaches a collection-creation code path (API, agent tool call, or self-service onboarding) that lets them influence the dimension parameter passed to PraisonAI's PGVector or Cassandra backend.

AML.T0049

Injection

Attacker submits a crafted string like '3); DROP TABLE tenant_secrets; --' as the dimension value, which PraisonAI interpolates unvalidated directly into the generated CREATE TABLE DDL.

Execution

The database driver executes the tampered DDL statement as-is, running the attacker's injected SQL/CQL alongside the legitimate table creation.

AML.T0036

Impact

Depending on the injected payload and DB account privileges, the attacker drops tables, exfiltrates tenant data, or corrupts the RAG knowledge base that feeds the AI system's responses.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~12d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade PraisonAI to 4.6.78 or later, which enforces the dimension argument as a validated integer before it reaches DDL generation. Until upgraded, add an application-layer guard that rejects any dimension value failing strict integer parsing (reject strings, symbols, or values outside a known allow-list such as 384/768/1536/3072) before it reaches PraisonAI's create_collection() call. Apply least-privilege database credentials to the service account PraisonAI uses — it should not have DROP/ALTER rights on tables outside its own vector schema. For detection, alert on unexpected DDL statements (CREATE/DROP/ALTER) in Postgres/Cassandra audit logs originating from the application's service account, and review recent collection-creation activity for anomalous dimension values containing SQL/CQL keywords or statement terminators.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage DoS RAG Agent Framework AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system verification and validation

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08:2025 - Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-60090?

PraisonAI's knowledge-store integrations for PGVector and Cassandra fail to validate the collection dimension parameter before interpolating it directly into the generated CREATE TABLE DDL, letting a caller inject arbitrary SQL or CQL tokens such as a DROP TABLE payload. This is a textbook CWE-89 injection with a CVSS 9.8 — network-reachable, no authentication or user interaction required, and full confidentiality/integrity/availability impact — in a package many teams already run as their agent orchestration layer. There's no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so this hasn't been weaponized in the wild as of this writing, but the fix is a one-line-of-reasoning bug class that's trivial to reproduce once the advisory is public. Patch to PraisonAI 4.6.78 or later immediately, and until you can confirm the patched version is deployed, treat any collection-creation code path (API endpoints, agent configs, multi-tenant onboarding) that lets a user influence the dimension value as untrusted input requiring strict integer allow-listing at your application layer as a compensating control.

Is CVE-2026-60090 actively exploited?

No confirmed active exploitation of CVE-2026-60090 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-60090?

Upgrade PraisonAI to 4.6.78 or later, which enforces the dimension argument as a validated integer before it reaches DDL generation. Until upgraded, add an application-layer guard that rejects any dimension value failing strict integer parsing (reject strings, symbols, or values outside a known allow-list such as 384/768/1536/3072) before it reaches PraisonAI's create_collection() call. Apply least-privilege database credentials to the service account PraisonAI uses — it should not have DROP/ALTER rights on tables outside its own vector schema. For detection, alert on unexpected DDL statements (CREATE/DROP/ALTER) in Postgres/Cassandra audit logs originating from the application's service account, and review recent collection-creation activity for anomalous dimension values containing SQL/CQL keywords or statement terminators.

What systems are affected by CVE-2026-60090?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, vector databases, agent frameworks, knowledge-store backends.

What is the CVSS score for CVE-2026-60090?

CVE-2026-60090 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesvector databasesagent frameworksknowledge-store backends

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenant_secrets; --' to inject SQL/CQL tokens into the statement executed by the database driver.

Exploitation Scenario

A SaaS product built on PraisonAI lets end users spin up their own knowledge base by configuring embedding settings, including vector dimension, through a self-service API or agent tool call. An attacker submits a collection-creation request with dimension set to the string '3); DROP TABLE tenant_secrets; --' instead of a numeric value. PraisonAI validates the schema, keyspace, and collection name but passes the dimension straight through into the generated CREATE TABLE statement, so the database driver executes the injected DROP TABLE statement (or, with a different payload, a UNION-based read against another tenant's data) with whatever privileges the application's DB account holds — resulting in data loss, cross-tenant data exposure, or corruption of the RAG index feeding the AI system's responses.

Weaknesses (CWE)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Primary CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]

Source: MITRE CWE corpus.