Findings

CVE-2026-60090

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

Published Oct 8, 2026 · updated Oct 15, 2026

# PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL ## Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled argument directly into vector column declarations. A caller that can influence collection creation dimensions can append SQL/CQL tokens to the generated DDL executed by the database driver. ## Technical Details The affected boundary is the vector-store collection creation API. The shared contract declares , but Python type hints are not enforced at runtime. Backends that interpolate that value into DDL must validate the runtime value before constructing SQL/CQL. already treats DDL identifier interpolation as security-sensitive: calls , and calls before returning . However, then executes: No equivalent type or range check runs on . Passing a string such as reaches the SQL sent to . has the same pattern. The constructor validates , and validates the collection name, but the vector column DDL uses: Passing a string such as reaches the CQL sent to . ## PoV This minimal PoV imports the real backend classes with fake database drivers, records the statements sent to the drivers, and compares a safe integer dimension with a malicious string dimension. It also attempts a malicious collection name as a negative control; current code rejects that name, proving the identifier hardening is active while the vector dimension remains unguarded. ## PoC Save the PoV script above as , then reproduce against current head: Decisive PGVector output: Decisive Cassandra output: The local controls also showed safe integer dimensions produce and without , while malicious collection names are rejected before driver execution. ## Impact This is a SQL/CQL injection sink in database DDL generation. Applications that expose RAG collection creation, tenant workspace provisioning, plugin-managed vector-store setup, or similar lower-trust confi