CVE-2026-60090

Katalog CVE

CVSS 9.8 · Critical EPSS 0,70%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenant_secrets; --' to inject SQL/CQL tokens into the statement executed by the database driver.

Rincian

Terbit di NVD

11 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 52,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wf65-4jjx-q444
• https://www.vulncheck.com/advisories/praisonai-before-sql-cql-injection-via-vector-dimension