PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries
Date: 2026-04
Affected: pip/PraisonAI
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-40315
CWE: CWE-89

### Summary The `table_prefix` configuration value is directly used to construct SQL table identifiers without validation. If an attacker controls this value, they can manipulate SQL query structure, leading to unauthorized data access (e.g., reading internal SQLite tables such as `sqlite_master`) and tampering with query results. --- ### Details This allows attackers to inject arbitrary SQL fragments into table identifiers, effectively altering query execution. This occurs because `table_prefix` is passed from configuration (`from_yaml` / `from_dict`) into `SQLiteConversationStore` and directly concatenated into SQL queries via f-strings: ```python sessions_table = f"{table_prefix}sessions" ``` This value is then used in queries such as: ```sql SELECT * FROM {self.sessions_table} ``` Since SQL identifiers cannot be safely parameterized and are not validated, attacker-controlled input can modify SQL query structure. The vulnerability originates from configuration input and propagates through the following flow: * **Source:** [config.py](https://github.com/MervinPraison/PraisonAI/blob/fde17acdc89cafd97ff49e9ddc81777b4445850f/src/praisonai/praisonai/persistence/config.py) (`from_yaml` / `from_dict`) accepts external configuration input * **Propagation:** [factory.py](https://github.com/MervinPraison/PraisonAI/blob/fde17acdc89cafd97ff49e9ddc81777b4445850f/src/praisonai/praisonai/persistence/factory.py) (`create_stores_from_config`) passes `conversation_options`


Mitigations:

Architectural layers (MAESTRO):