CVE-2026-40315: 
Python vulnerability analysis and mitigation

CVE-2026-40315 is an SQL identifier injection vulnerability in PraisonAI's SQLiteConversationStore component, a multi-agent AI teams framework. The vulnerability exists in all versions prior to 4.5.133, where the table_prefix configuration value is directly concatenated into SQL queries via Python f-strings without any validation or sanitization. It was published on April 14, 2026, and patched in version 4.5.133. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory, Feedly).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically an SQL identifier injection flaw. The table_prefix value is accepted from external configuration sources (from_yaml or from_dict in config.py), passed without validation through factory.py, and then directly interpolated into SQL table identifiers in sqlite.py using f-strings (e.g., sessions_table = f"{table_prefix}sessions" and SELECT * FROM {self.sessions_table}). Because SQL identifiers cannot be safely parameterized, an attacker who controls table_prefix can inject arbitrary SQL fragments — including UNION-based payloads — to alter query structure and access unintended data. The fix, committed in 0accebb, adds a regex validation (^[a-zA-Z0-9_]*$) to reject any table_prefix containing characters outside alphanumerics and underscores (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to read internal SQLite tables such as sqlite_master, disclosing the full database schema, and to manipulate query results through UNION-based injection, effectively tampering with all data returned by affected queries. This results in high confidentiality and integrity impact against the PraisonAI conversation store database. Availability is not directly impacted, but the ability to tamper with agent session data could disrupt multi-agent workflows and enable further privilege escalation within the application (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating UNION-based query manipulation via a malicious table_prefix value. The PoC shows that attacker-controlled input can replace legitimate session data with results from sqlite_master, confirming the injection is functional. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.022% (0.000220), indicating low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Identify target: Locate a PraisonAI deployment running a version prior to 4.5.133 that accepts external configuration input (e.g., via YAML or dictionary-based configuration files).
2. Craft malicious configuration: Prepare a configuration payload where table_prefix contains an injected SQL fragment, for example:

table_prefix: "praison_sessions WHERE 1=0 UNION SELECT name as session_id, NULL as user_id, NULL as agent_id, NULL as name, NULL as state, NULL as metadata, 0 as created_at, 0 as updated_at FROM sqlite_master -- "

3. Inject configuration: Supply this malicious configuration via from_yaml or from_dict input to the PraisonAI application, which passes table_prefix through config.py → factory.py → sqlite.py without validation.
4. Trigger query execution: Invoke any operation that calls list_sessions() or similar methods on SQLiteConversationStore, causing the injected SQL to execute.
5. Exfiltrate schema data: The UNION-based payload causes the query to return rows from sqlite_master instead of legitimate session data, disclosing internal table names, schema definitions, and other metadata.
6. Extend attack: Use disclosed schema information to craft further injections targeting specific tables for data exfiltration or result tampering (GitHub Advisory).

• Logs: Application logs showing ValueError: table_prefix must contain only alphanumeric characters and underscores (post-patch) may indicate attempted exploitation; absence of such errors on unpatched systems does not rule out exploitation.
• Database: Unexpected query results containing SQLite internal table names (e.g., sqlite_schema, sqlite_master, praison_sessions, praison_messages) appearing in session listings or agent outputs.
• File System: Presence of unusual or externally-supplied YAML configuration files with table_prefix values containing SQL keywords (UNION, SELECT, WHERE, FROM, --) or special characters beyond alphanumerics and underscores.
• Process/Application Behavior: PraisonAI returning unexpected session data structures, schema metadata, or empty legitimate session results where data is expected, indicating query result tampering (GitHub Advisory).

Upgrade PraisonAI to version 4.5.133 or later, which introduces regex-based validation of table_prefix to only allow alphanumeric characters and underscores (^[a-zA-Z0-9_]*$). As an interim workaround, restrict access to configuration inputs and enforce strict controls on who can modify table_prefix settings in YAML or dictionary configurations. Audit all deployments for externally-supplied configuration files and review table_prefix values for suspicious content (Patch Commit, GitHub Advisory).

The vulnerability was reported by researcher choseogyeong and credited in the GitHub Security Advisory. A brief social media mention was observed on Bluesky via the CVE tracking account. Coverage has been limited to automated vulnerability aggregators and threat intelligence feeds, with no major security media coverage or notable researcher commentary beyond the advisory itself (GitHub Advisory).