CVE-2026-60090

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78

Description The PGVector and Cassandra knowledge-store create collection() backends fail to validate the caller-controlled dimension argument. While schema, keyspace, and collection-name identifiers are validated, the dimension value is interpolated directly into the vector column of the generated CREATE TABLE DDL (Data Definition Language). This allows a caller to inject SQL or CQL tokens into the statement executed by the database driver by passing a malicious string through the dimension variable.

Recommendations Update PraisonAI to version 4.6.78 or later. As a temporary workaround, restrict access to the create collection() function to prevent unauthorized users from influencing the dimension argument.