EUVD-2026-12373
GHSA-6mj8-jmp2-g8q7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 3 pypi packages depend on vanna (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.2.
DescriptionCVE.org
A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigquery_vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Vanna AI's BigQuery integration (versions up to 2.0.2) allows unauthenticated remote attackers to manipulate the remove_training_data function through unsanitized ID parameters. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. Successful exploitation enables attackers to read, modify, or delete database contents with limited impact on confidentiality, integrity, and availability.
Technical ContextAI
The Vanna library is an AI-powered SQL assistant that helps generate SQL queries from natural language. The vulnerability affects the BigQuery vector storage implementation in src/vanna/legacy/google/bigquery_vector.py, where the remove_training_data function fails to properly sanitize the ID parameter before constructing SQL queries. This is a classic SQL injection vulnerability (CWE-89) where user-controlled input is concatenated directly into SQL statements without proper parameterization or escaping. The affected product is identified by CPE cpe:2.3:a:vanna-ai:vanna:*:*:*:*:*:*:*:* for versions up to and including 2.0.2.
RemediationAI
Since the vendor has not responded to the vulnerability disclosure and no patch is currently available, organizations should immediately assess their exposure to this vulnerability. If using Vanna versions up to 2.0.2 with BigQuery integration, consider temporarily disabling the affected remove_training_data functionality or implementing input validation at the application layer to sanitize ID parameters before they reach the vulnerable function. Monitor the vendor's repository for security updates and consider switching to alternative SQL assistant tools if the vendor continues to be unresponsive. The proof-of-concept exploit code at https://gist.github.com/YLChen-007/b4f326eaecc29b192cf93dc5d6bc0623 can be used to test your systems for vulnerability.
Arbitrary file write and unauthorized file read in Vanna (the open-source AI SQL agent) through version 2.0.2 allows una
Missing authentication in vanna-ai vanna Chat API endpoint (/api/vanna/v2/) allows unauthenticated remote attackers to p
Improper authorization in Vanna AI's Legacy Flask API allows remote unauthenticated attackers to bypass authentication c
Server-side request forgery in Vanna AI versions up to 2.0.2 allows unauthenticated remote attackers to manipulate the u
A code injection vulnerability exists in vanna-ai vanna up to version 2.0.2, specifically in the exec function of the /s
SQL injection in vanna-ai vanna versions up to 2.0.2 allows authenticated remote attackers to manipulate the ask functio
SQL injection in Vanna up to version 2.0.2 allows authenticated remote attackers to execute arbitrary SQL queries throug
Cross-Origin Resource Sharing (CORS) misconfiguration in vanna-ai vanna up to version 2.0.2 allows authenticated remote
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today