EUVD-2026-14244Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads to injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A code injection vulnerability exists in vanna-ai vanna up to version 2.0.2, specifically in the exec function of the /src/vanna/legacy file. This authenticated remote code injection allows attackers with login credentials to execute arbitrary code with limited impact on confidentiality, integrity, and availability. A proof-of-concept exploit has been publicly disclosed on GitHub, and the vendor has not responded to early disclosure notifications, making this an active concern for deployed instances.
Technical ContextAI
The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which describes unsafe handling of user input before passing it to dangerous functions. The vanna-ai vanna product (cpe:2.3:a:vanna-ai:vanna:*:*:*:*:*:*:*:*) is a Python-based AI framework for natural language to SQL processing. The exec function in the legacy module appears to dynamically execute code without proper input validation or sanitization, allowing attackers to inject malicious code that gets interpreted as executable Python. This is a classic injection vulnerability where user-controlled input reaches a dangerous function (exec) without neutralization.
RemediationAI
Immediately upgrade vanna-ai vanna to a version newer than 2.0.2 if available from the vendor; however, since the vendor has not responded to disclosure and no official advisory exists, check the vanna GitHub repository or PyPI for the latest patched version. As an interim mitigation, restrict access to vanna deployments to trusted users only, disable or remove the legacy module if it is not required for your use case, implement network segmentation to limit lateral movement in case of code execution, and monitor for suspicious activity in vanna application logs. Consider implementing a Web Application Firewall (WAF) or input validation layer in front of vanna to detect injection attempts. Until a vendor patch is confirmed available, avoid deploying vanna-ai in environments where authentication alone cannot be trusted.
Arbitrary file write and unauthorized file read in Vanna (the open-source AI SQL agent) through version 2.0.2 allows una
Missing authentication in vanna-ai vanna Chat API endpoint (/api/vanna/v2/) allows unauthenticated remote attackers to p
Improper authorization in Vanna AI's Legacy Flask API allows remote unauthenticated attackers to bypass authentication c
Server-side request forgery in Vanna AI versions up to 2.0.2 allows unauthenticated remote attackers to manipulate the u
SQL injection in Vanna AI's BigQuery integration (versions up to 2.0.2) allows unauthenticated remote attackers to manip
SQL injection in vanna-ai vanna versions up to 2.0.2 allows authenticated remote attackers to manipulate the ask functio
SQL injection in Vanna up to version 2.0.2 allows authenticated remote attackers to execute arbitrary SQL queries throug
Cross-Origin Resource Sharing (CORS) misconfiguration in vanna-ai vanna up to version 2.0.2 allows authenticated remote
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today