CVE-2026-60090 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-60090 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-60090 is a critical SQL/CQL injection flaw in PraisonAI before 4.6.78 affecting the PGVector and Cassandra knowledge-store create_collection() backends. The issue occurs because the caller-controlled dimension argument is not validated at runtime and is inserted directly into the generated CREATE TABLE statement. An attacker who can influence collection creation can inject database tokens such as '3); DROP TABLE tenant_secrets; -- and potentially execute destructive commands through the database driver.

This is CVSS 9.8. It is not known to be exploited in the wild and is not in CISA KEV at the time of writing, but the impact is severe enough that solo developers and small teams should treat it as an urgent patch-and-verify event.

Immediate Action

  • Upgrade PraisonAI immediately to 4.6.78 or later. If you cannot patch right away, disable any feature path that allows users or external input to create collections.
  • Isolate the service from production databases until fixed: restrict DB credentials, network access, and write permissions to the minimum required.
  • Rollback or freeze collection-creation workflows if they are exposed via API, UI, agents, or automation jobs.
  • Rotate database credentials after patching if there is any chance untrusted input reached create_collection().
  • Review logs for suspicious DDL around collection creation, especially unexpected parentheses, semicolons, comments, or dropped tables.
  • Check vendor guidance: PraisonAI security advisory / release notes.

Affected Versions

  • praisonai<4.6.78 vulnerable
  • praisonai==4.6.78 and later safe, per current advisory
  • If your app vendors or bundles PraisonAI, any downstream package or container image containing a pre-4.6.78 build is also vulnerable

Resolution Guide

Python / pip

python -m pip install --upgrade "praisonai>=4.6.78"
python -m pip show praisonai

pipx

pipx upgrade praisonai
pipx list

Node / npm, yarn, pnpm (only if you consume PraisonAI through a wrapper or bundled package)

npm i praisonai@^4.6.78
yarn add praisonai@^4.6.78
pnpm add praisonai@^4.6.78
npm ls praisonai

Java / Maven / Gradle (for projects embedding the affected component)

<dependency>
  <groupId>TODO.groupId</groupId>
  <artifactId>TODO.artifactId</artifactId>
  <version>4.6.78</version>
</dependency>

./gradlew dependencies | grep -i praison
mvn dependency:tree | grep -i praison

Linux package managers (if your distro or internal repo ships it)

sudo apt update
sudo apt install --only-upgrade praisonai
sudo yum update praisonai

Docker

docker pull TODO_REGISTRY/praisonai:4.6.78
docker run --rm TODO_REGISTRY/praisonai:4.6.78 --version

Config hardening

# Disable collection creation from untrusted callers
PRAISONAI_DISABLE_COLLECTION_CREATE=true

# If available in your deployment, restrict to read-only / preprovisioned stores
PRAISONAI_KNOWLEDGE_STORE_MODE=readonly

Minimal code fix example — enforce integer bounds before building DDL:

def create_collection(name, dimension, *args, **kwargs):
    if not isinstance(dimension, int):
        raise TypeError("dimension must be an integer")
    if dimension < 1 or dimension > 65535:
        raise ValueError("dimension out of range")

    # Safe: use validated integer only
    ddl = f"CREATE TABLE {safe_name} (... vector({dimension}) ...)"
    execute_ddl(ddl)

Detection & Verification

Check installed version:

python -m pip show praisonai
python -c "import praisonai; print(getattr(praisonai, '__version__', 'unknown'))"

Search code for the vulnerable path:

grep -R "create_collection" -n .
grep -R "vector(" -n .
grep -R "dimension" -n praisonai/

Look for unsafe interpolation in the backend code:

grep -R "f.*dimension" -n praisonai/
grep -R "format(.*dimension" -n praisonai/

Dependency audit:

pip-audit
uv pip audit
safety check

Verify the fix by attempting a malicious input in a test environment only:

# Expected result after patch: rejection, not execution
dimension="3); DROP TABLE tenant_secrets; --"

Confirm the application throws a validation error and that no DDL is emitted to the database logs. Also verify the runtime version is 4.6.78+ and that any container image or lockfile has been updated.

Risk and Impact

This flaw can turn a simple collection-creation request into arbitrary SQL/CQL token injection, which may lead to table drops, data corruption, or unauthorized schema changes. In a small-team environment, the blast radius can include the primary app database, tenant data, secrets tables, and any downstream jobs that trust the knowledge-store schema.

Because the vulnerable code sits in a backend that generates DDL, the impact is especially dangerous if collection creation is exposed through APIs, agents, admin panels, or automation. Even without known active exploitation, the combination of critical severity and direct database impact makes immediate remediation the safest path.

Keep reading