Search: CVE-2026-40315

CVE-2026-40315 is an SQL injection vulnerability in MervinPraison's PraisonAI versions prior to 4.5.133. The issue arises because the table_prefix configuration value is directly concatenated into SQL queries without validation or sanitization, allowing an attacker who can control this value to inject arbitrary SQL code. Exploitation can lead to unauthorized access to internal SQLite tables and manipulation of query results. This vulnerability has been fixed in version 4.5.133.