PraisonAI Vector Store Dimension SQL/CQL Injection

Technical Analysis

The vulnerability stems from a type-confusion trust flaw: while schema, keyspace, and collection-name identifiers are sanitized, the dimension argument (nominally typed as int) is never enforced at runtime and is instead string-interpolated directly into the CREATE TABLE DDL executed against PGVector or Cassandra. An attacker supplying a malicious string such as '3); DROP TABLE tenant_secrets; --' can terminate the intended statement and inject arbitrary SQL/CQL, enabling data destruction, exfiltration of tenant data, or privilege escalation within the database. This is a classic injection-via-untyped-parameter bug, exploitable wherever collection dimension values originate from user- or agent-controlled input rather than hardcoded configuration. Because PraisonAI is used as a knowledge-store/RAG backend for autonomous AI agents, any agent framework that dynamically creates vector collections based on user prompts, tool outputs, or external API responses could pass attacker-influenced dimension values, turning prompt injection or malicious tool output into direct database compromise. This significantly raises the blast radius for agentic RAG pipelines, where an LLM's own reasoning chain could be manipulated into supplying the malicious dimension string.

Affected Systems

PraisonAI versions prior to 4.6.78; deployments using the PGVector knowledge-store backend; deployments using the Cassandra knowledge-store backend; any RAG or agent pipeline that dynamically invokes create_collection() with externally influenced dimension values

Indicators of Compromise

• N/A - vulnerability is a code-level logic flaw, no known malware hashes or C2 infrastructure associated at this time

Remediation Steps

1. 1

   Upgrade PraisonAI

   Update to PraisonAI version 4.6.78 or later, which enforces runtime type validation on the dimension parameter.

2. 2

   Input validation

   If immediate upgrade is not possible, add strict server-side validation to reject any non-integer or out-of-range values for the dimension parameter before it reaches create_collection().

3. 3

   Restrict collection creation

   Limit which callers, agents, or API endpoints are permitted to invoke create_collection() with dynamic dimension values; prefer hardcoded/admin-configured dimensions over user- or agent-supplied ones.

4. 4

   Database least privilege

   Ensure the database role used by PraisonAI has minimal privileges (no DROP/ALTER on unrelated tables) to limit blast radius if injection occurs.

5. 5

   Audit RAG pipelines

   Review agent workflows that construct vector store schemas dynamically from LLM output or tool responses, and add sanitization layers between agent reasoning and database DDL execution.

6. 6

   Monitor database logs

   Enable and review query logging on PGVector/Cassandra instances for anomalous DDL statements or unexpected DROP/ALTER commands.