ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-60090

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

Published Oct 8, 2026 · catalog updated Oct 15, 2026 · PraisonAI: PGVector and Cassandra

Check if you run it

No confirmed exploitation is on record for CVE-2026-60090. EPSS is 0.70%. Act only if a listed version of PraisonAI: PGVector and Cassandra is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (PraisonAI: PGVector and Cassandra).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.70%
Remediation
Advisory link
Affected products
PyPI praisonai

# PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL ## Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled argument directly into vector column declarations. A caller that can influence collection creation dimensions can append SQL/CQL tokens to the generated DDL executed by the database driver. ## Technical Details The affected boundary is the vector-store collection creation API. The shared contract declares , but Python type hints are not enforced at runtime. Backends that interpolate that value into DDL must validate the runtime value before constructing SQL/CQL. already treats DDL identifier interpolation as security-sensitive: calls , and calls before returning . However, then executes: No equivalent type or range check runs on . Passing a string such as reaches the SQL sent to . has the same pattern. The constructor validates , and validates the collection name, but the vector column DDL uses: Passing a string such as reaches the CQL sent to . ## PoV This minimal PoV imports the real backend classes with fake database drivers, records the statements sent to the drivers, and compares a safe integer dimension with a malicious string dimension. It also attempts a malicious collection name as a negative control; current code rejects that name, proving the identifier hardening is active while the vector dimension remains unguarded. ## PoC Save the PoV script above as , then reproduce against current head: Decisive PGVector output: Decisive Cassandra output: The local controls also showed safe integer dimensions produce and without , while malicious collection names are rejected before driver execution. ## Impact This is a SQL/CQL injection sink in database DDL generation. Applications that expose RAG collection creation, tenant workspace provisioning, plugin-managed vector-store setup, or similar lower-trust confi

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI praisonai0 → 4.6.78

How to fix CVE-2026-60090

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-60090. EPSS is 0.70%. Act only if a listed version of PraisonAI: PGVector and Cassandra is installed.

Which versions are affected?

Compare what you have installed with 0 → 4.6.78. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-89: SQL Injection; CWE-943. EPSS 0.70%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 8, 2026 · GitHub Advisory Database

    Detected

    # PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL ## Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled argument directly into vector column declarations. A caller that can influence collection creation dimensions can append SQL/CQL tokens to t

  2. Oct 8, 2026 · GitHub Advisory Database

    Fix available

    praisonai fixed in 4.6.78

  3. Oct 8, 2026 · GitHub Advisory Database

    Fix available

    praisonai fixed in 4.6.78

  4. Oct 8, 2026 · GitHub Advisory Database

    Updated

    # PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL ## Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled argument directly into vector column declarations. A caller that can influence collection creation dimensions can append SQL/CQL tokens to t

  5. Oct 15, 2026 · GitHub Advisory Database

    Updated

    # PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL ## Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled argument directly into vector column declarations. A caller that can influence collection creation dimensions can append SQL/CQL tokens to t

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.