VannaGHSA-rrqq-fv6m-692m
vanna vulnerable to remote code execution caused by prompt injection
Critical9.8CVE-2024-5826 · Published Jun 27, 2024 · updated Jun 29, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vanna PyPI | <= 0.6.2 | No fix yet |
Details and references
In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection. The root cause is the lack of a sandbox when executing LLM-generated code, allowing an attacker to manipulate the code executed by the `exec` function in `src/vanna/base/base.py`. This vulnerability can be exploited by an attacker to achieve remote code execution on the app backend server, potentially gaining full control of the server.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2024-5826, PYSEC-2026-562
More Vanna advisories
All Vanna| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 52024 | Vanna vulnerable to SQL Injection CVE-2024-5753High7.5no fix yet | High7.5 | No fix yet |
| May 312024 | Vanna prompt injection code execution CVE-2024-5565Critical8.1no fix yet | Critical8.1 | No fix yet |
| Mar 16 | Vanna has a SQL injection in the remove_training_data function CVE-2026-4229Medium7.3no fix yet | Medium7.3 | No fix yet |