CVE-2026-34934 - Vulnerability Analysis

Overview

PraisonAI < 4.5.90 contains a SQL injection caused by unescaped thread IDs in get_all_user_threads function, letting attackers execute arbitrary SQL queries and gain full database access, exploit requires storing malicious thread ID.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands, leading to full database compromise.

Mitigation

Update to version 4.5.90 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cq8-3v94-434g

Social Media Activity(1 post)

OffSequence

@offseq

Apr 4, 2026

🚨 CVE-2026-34934: PraisonAI <4.5.90 affected by CRITICAL SQL injection (CVSS 9.8). Unauthenticated attackers can gain full DB access via unsanitized thread IDs. Upgrade to 4.5.90+ ASAP. Details: https://radar.offseq.com/threat/cve-2026-34934-cwe-89-improper-neutralization-of-s-2e7eac46 #OffSeq #infosec #SQLInjection #PraisonAI

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner