Medium severity6.3NVD Advisory· Published May 8, 2026· Updated May 8, 2026

CVE-2026-44337

Description

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. This issue has been patched in version 4.6.34.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
PraisonAIPyPI	>= 2.4.1, < 4.6.34	4.6.34

Affected products

Praison/Praisonai
cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*
Range: >=2.4.1,<4.6.34
ghsa-coords
pkg:pypi/praisonai
Range: >= 2.4.1, < 4.6.34

Patches

Vulnerability mechanics

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3643-7v76-5cj2nvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-3643-7v76-5cj2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-44337ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000