EUVD-2026-14246
GHSA-jvhj-49gh-v77p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function ask of the file vanna\legacy\base\base.py. Performing a manipulation results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in vanna-ai vanna versions up to 2.0.2 allows authenticated remote attackers to manipulate the ask function in vanna/legacy/base/base.py, potentially enabling data exfiltration or modification. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
Technical ContextAI
Vanna-ai vanna is a text-to-SQL AI framework (identified by CPE cpe:2.3:a:vanna-ai:vanna:*:*:*:*:*:*:*:*) that translates natural language queries into SQL statements. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user input passed to the ask function is not properly sanitized or parameterized before being incorporated into SQL queries. This is a fundamental input validation flaw where the application concatenates or interpolates user-controlled data directly into SQL statements without using prepared statements or parameterized queries.
RemediationAI
Immediately upgrade vanna-ai vanna to version 2.0.3 or later if available from the project repository or PyPI package index; however, verify patch status given vendor non-responsiveness. If a patched version is unavailable, implement strict input validation and parameterized query enforcement at the application code level by modifying the ask function to use SQL parameterized queries (prepared statements) rather than string concatenation. As an interim control, restrict network access to vanna deployments using firewall rules and network segmentation to limit exposure to trusted internal networks only, and enforce strict role-based access controls to ensure only necessary users have credentials to authenticate to the system. Monitor the official vanna-ai GitHub repository and release notes for security updates, and consider forking the project to apply your own patches if vendor updates are not forthcoming.
Arbitrary file write and unauthorized file read in Vanna (the open-source AI SQL agent) through version 2.0.2 allows una
Missing authentication in vanna-ai vanna Chat API endpoint (/api/vanna/v2/) allows unauthenticated remote attackers to p
Improper authorization in Vanna AI's Legacy Flask API allows remote unauthenticated attackers to bypass authentication c
Server-side request forgery in Vanna AI versions up to 2.0.2 allows unauthenticated remote attackers to manipulate the u
SQL injection in Vanna AI's BigQuery integration (versions up to 2.0.2) allows unauthenticated remote attackers to manip
A code injection vulnerability exists in vanna-ai vanna up to version 2.0.2, specifically in the exec function of the /s
SQL injection in Vanna up to version 2.0.2 allows authenticated remote attackers to execute arbitrary SQL queries throug
Cross-Origin Resource Sharing (CORS) misconfiguration in vanna-ai vanna up to version 2.0.2 allows authenticated remote
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today