CVE-2026-40315 is a SQL injection flaw in PraisonAI, scored CVSS 9.8. The table_prefix setting of SQLiteConversationStore is joined into queries without validation, so a controlled value can change the query. It is fixed in 4.5.133. Upgrade, and check where your configuration comes from.
What's affected
- Affected: PraisonAI before 4.5.133
- Fixed: 4.5.133
The advisory traces the value from configuration input in config.py through factory.py to the query construction in sqlite.py. Exploitation requires the ability to influence configuration, for example through from_yaml or from_dict input. The record says that can expose internal tables such as sqlite_master and allow tampering with query results.
How to check if you're exposed
Check the version:
pip show praisonai
Then look at how you build your configuration. If a YAML file or dictionary passed to the conversation store can be written or influenced by someone outside your team, such as a user upload or a shared repository, that is the exposure.
What to do now
- Upgrade PraisonAI to 4.5.133 or later.
- Treat configuration files as code. Restrict who can write them.
- Do not build conversation store settings from user supplied input.
- If you must accept a prefix, restrict it to a short allow list of letters and digits.
Why it matters
The weakness is CWE-89, SQL injection. Table names cannot be passed as query parameters, so developers join them into the query as text. That is safe only when the value is checked first. Here it was not.
The vector is scored network reachable with no privileges, but the advisory itself says exploitation depends on being able to influence configuration. Read the score as an upper bound and your own configuration flow as the real measure. The record does not flag exploitation in the wild.
Quick check
Can parameterized queries fix identifier injection?
Not for table or column names. Validate against an allow list instead, which is the direction the advisory points in.
Sources
Last reviewed: 19 October 2026.
