Cloudanix VulnDB

GHSA-x783-xp3g-mqhp

Medium · 6.5

PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries

CVSS

6.5

EPSS

—

Published

Apr 10, 2026

CISA due date

—

The record

The `table_prefix` configuration value is directly used to construct SQL table identifiers without validation. If an attacker controls this value, they can manipulate SQL query structure, leading to unauthorized data access (e.g., reading internal SQLite tables such as `sqlite_master`) and tampering with query results. ---

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities