The vulnerability CVE-2026-34934 in PraisonAI versions before 4.5.90 involves improper neutralization of special elements in SQL commands (CWE-89). Specifically, the get_all_user_threads function uses Python f-strings to build raw SQL queries with thread IDs that are not escaped or sanitized. An attacker can exploit this by storing a malicious thread ID through the update_thread function, which leads to execution of arbitrary SQL commands when the thread list is loaded. This results in full database compromise. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. The vendor has patched this vulnerability in version 4.5.90.

Exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands on the PraisonAI database, leading to full confidentiality, integrity, and availability compromise of the database. This includes potential data theft, modification, or deletion. The CVSS score of 9.8 reflects the high impact and ease of exploitation over the network without privileges or user interaction.

This vulnerability has been patched in PraisonAI version 4.5.90. Users should upgrade to version 4.5.90 or later to remediate this issue. No other mitigation or temporary workaround is indicated in the available data.