PraisonAI's knowledge-store backends for SQL and CQL databases interpolate unvalidated collection and name parameters directly into query strings, leading to potential SQL and CQL injection vulnerabilities. This affects the pgvector, Cassandra, and SingleStore vector backends. The issue arises because these backends do not validate or quote collection names before using them in dynamic SQL/CQL statements. A validation function exists elsewhere in the codebase but is not applied here. Versions from 2.4.1 up to but not including 4.6.34 are affected. A fix is available in version 4.6.34.