CVE-2026-40315

@@ -40,7 +40,7 @@ steps:
     action: |
       Implement the changes required to solve the issue:
       1. Review the analyst's plan.
-      2. Check out a dedicated fix branch by calling `execute_command` with `command` set to `git checkout -b praisonai/issue-$ISSUE_NUMBER`. Do NOT provide a `cwd` argument.
+      2. Check out a dedicated fix branch by calling `execute_command` with `command` set to `git checkout -b praisonai/issue-{{ISSUE_NUMBER}}`. Do NOT provide a `cwd` argument.
       3. Carefully modify the necessary files in the repository using bash commands (e.g. `cat`, `sed`, `echo`, or small inline scripts). 
       4. Double-check your edits by inspecting the file outputs or running `git diff` to ensure you changed what was required.
     expected_output: "Confirmation that the git branch was successfully created and the files were reliably modified without syntax errors."
@@ -52,7 +52,7 @@ steps:
       1. Stage the files with `execute_command` where `command` is `git add .`. Do NOT provide a `cwd` argument.
       2. Commit the changes: `git commit -m "PraisonAI Automated Fix"`
       3. Push the branch to GitHub: `git push -u origin HEAD`
-      4. Create the Pull Request back to main: `gh pr create --title "Fix Issue $ISSUE_NUMBER" --body "Automated triage by PraisonAI Native Issue Triage." --head "praisonai/issue-$ISSUE_NUMBER" --base main`
-      5. Post a comment on the original issue letting the user know: `gh issue comment $ISSUE_NUMBER -b "I have autonomously analyzed the codebase and written a fix for this issue! I've opened a Pull Request for your review."`
+      4. Create the Pull Request back to main: `gh pr create --title "Fix Issue {{ISSUE_NUMBER}}" --body "Automated triage by PraisonAI Native Issue Triage." --head "praisonai/issue-{{ISSUE_NUMBER}}" --base main`
+      5. Post a comment on the original issue letting the user know: `gh issue comment {{ISSUE_NUMBER}} -b "I have autonomously analyzed the codebase and written a fix for this issue! I've opened a Pull Request for your review."`
     expected_output: "The URL of the successfully created Pull Request."
     dependencies: [analyze_issue, implement_fix]

@@ -203,6 +203,7 @@ def __init__(
         """
         self.config = config or GatewayConfig(host=host, port=port)
         if hasattr(self.config, 'auth_token') and not self.config.auth_token:
+            import secrets
             self.config.auth_token = secrets.token_hex(16)
             logger.warning(
                 f"No auth_token provided for Gateway server. Generated temporary token: {self.config.auth_token}. "

@@ -46,6 +46,12 @@ def __init__(
             check_same_thread: SQLite check_same_thread parameter
         """
         self.path = path
+        
+        # Prevent SQL injection in table identifiers
+        import re
+        if not re.match(r'^[a-zA-Z0-9_]*$', table_prefix):
+            raise ValueError("table_prefix must contain only alphanumeric characters and underscores")
+            
         self.table_prefix = table_prefix
         self.sessions_table = f"{table_prefix}sessions"
         self.messages_table = f"{table_prefix}messages"