CVE-2026-41496 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Attackers can execute arbitrary SQL commands via unvalidated table prefixes in multiple database backends, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41496?
CVE-2026-41496 is a high-severity SQL injection vulnerability in MervinPraison PraisonAI, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass table_prefix straight into f-string SQL. Same root cause, same code pattern, same exploitation. 52 unvalidated injection points across the codebase. postgres.py additionally accepts an unvalidated schema parameter used directly in DDL. This issue has been patched in praisonai version 4.6.9 and praisonaiagents version 1.6.9.
Weakness: CWE-89
Which versions are affected by CVE-2026-41496?
6 open source packages ship an affected version, including praisonai and praisonaiagents. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.5.149 |
praisonai PyPI | All versions | 4.5.149 |
praisonai PyPI | All versions | 4.5.149 |
praisonaiagents PyPI | All versions | 1.6.8 |
praisonaiagents PyPI | All versions | 1.6.8 |
praisonaiagents PyPI | All versions | 1.6.8 |
Products include Praison Praisonai, Praison Praisonaiagents.
How do I fix CVE-2026-41496?
Upgrade praisonai to 4.5.149 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-41496 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41496 exists.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
Sources
Also known as GHSA-rg3h-x3jw-7jm5, PYSEC-2026-2923, PYSEC-2026-2952.