EUVD-2026-91760
GHSA-349g-39fc-mvhj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed vanna plotting endpoint
-
DeliverySubmit crafted question/prompt
-
ExploitPoison LLM-generated Plotly code
-
ExecutionTrigger exec in get_plotly_figure
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the deploying application to expose vanna's figure/plot-generation entry (VannaBase.get_plotly_figure) to attacker-influenced input - the description's 'Depending on the exposed entry' is the governing condition. vanna generates and then executes Plotly code derived from LLM output, so an attacker who can shape the question/prompt reaching an exposed plotting flow (such as vanna's bundled Flask/Streamlit/API front-ends) achieves code/command execution. Limiting factors: deployments that embed vanna without exposing the plotting path, or that gate the ask/plot endpoint behind authentication or restrict who can influence prompts, are substantially less exposed than the 9.8 implies. Affected build confirmed only as v2.0.2. |
| Impact | Signals conflict and must be weighed carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes an unauthenticated remote code-execution path, consistent with CWE-94 and the RCE tag. However, the EPSS score is very low (0.36%, 27th percentile), the CVE is NOT in CISA KEV, and exploitation status is 'publicly available exploit code exists' (a researcher gist is referenced) rather than confirmed in-the-wild activity. The most important caveat is in the description itself: 'Depending on the exposed entry' - this means the raw 9.8 is conditional on the deploying application actually exposing the Plotly figure-generation path to attacker-influenced input. For deployments that expose vanna's plotting/ask flow (e.g., the bundled web apps) this is a genuine critical-priority server-side RCE; for libraries embedded without exposing that entry, real-world risk drops sharply. Net: treat as high priority for anyone running vanna's web/API surface, but the low EPSS and conditional exposure mean this is more likely targeted/opportunistic than mass-exploited at present. Verify your own deployment exposes get_plotly_figure before assuming the 9.8 applies. |
| Exploit ScenarioDerived | An application built on vanna v2.0.2 exposes the text-to-SQL 'ask' flow with chart generation over a web endpoint. An attacker submits a crafted question/prompt that steers the LLM-generated Plotly code so that VannaBase.get_plotly_figure executes attacker-controlled Python, yielding command execution on the server. Public proof-of-concept material is referenced (researcher gist), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Code injection in Vanna 2.0.2's VannaBase.get_plotly_figure presents conflicting signals that must be weighed carefully: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), yet EPSS is only 0.36% (27th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis. In CVSS terms this is an unauthenticated remote issue, but the governing exploitation condition is that a deploying application exposes vanna's figure/plot-generation entry to attacker-influenced input; where the plotting path is exposed via bundled Flask/Streamlit/API front ends, an attacker who can shape the question or prompt can achieve attacker-controlled code or command execution, while embedded deployments that gate, authenticate, or do not expose that path are substantially less exposed than the 9.8 score implies.
RemediationAI
No vendor-released patch identified in the provided data at time of analysis; monitor the vendor repository https://github.com/vanna-ai/vanna and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-51911 for an update, and treat any future fixed version as the primary remediation. Until a patch is available, remove or disable the VannaBase.get_plotly_figure plotting path if chart generation is not required, which eliminates the vulnerable execution flow at the cost of losing Plotly figure functionality. If plotting must remain, do not expose the bundled Flask/Streamlit/API front ends to untrusted networks; require authentication and authorization on every endpoint that reaches the ask/plot flow, restrict who can influence prompts, and rate-limit or log those calls, with the trade-off that legitimate users must be provisioned and anonymous charting will stop working. Additionally, run Vanna in a sandboxed, least-privilege process with no unnecessary outbound network access, a read-only filesystem, and OS-level confinement such as seccomp or AppArmor, accepting that some legitimate Plotly rendering or data access may break. Input filtering or prompt hardening should be treated as defense-in-depth only because the root cause is unsafe execution of LLM-generated code, not a single malformed string.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-51911 is a CWE-94 code injection in the Python-based Vanna framework, specifically VannaBase.get_plotly_figure in src/vanna/legacy/base/base.py. Vanna uses LLM output to generate and then execute Plotly/Python plotting code; because attacker-influenced prompt content can reach that generation step, the code path lacks sufficient separation between untrusted input and executed code, allowing arbitrary code or command execution depending on the exposed entry. The supplied CPE string is a placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*), and EUVD lists affected versions as n/a n/a, so the only confirmed affected build from the input is v2.0.2; the CVSS vector rates network attack, low complexity, no privileges, and no user interaction, but the independent assessment stresses that the deploying application must expose the figure/plot-generation entry for exploitation.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable exec of LLM-generated Plotly code via an exposed plotting entry gives unauthenticated RCE (PR:N/AC:L) with full host C/I/A impact; scope unchanged (S:U).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
Executive ViewAI
A critical code-injection flaw in Vanna 2.0.2, an open-source text-to-SQL and charting library embedded in internal analytics tools, allows an unauthenticated remote party to execute attacker-controlled code on any deployment where the plot-generation path is reachable from user-supplied questions or prompts. The true organizational exposure is concentrated in teams that wrapped Vanna in Flask, Streamlit, or API front ends without authentication or input gating; those services should be treated as internet-exposed until proven otherwise. Leadership should care because a single reachable analytics chatbot could become an unauthenticated foothold into the network, even though no public exploit code or active exploitation has been observed to date.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce authentication and authorization on every Vanna-backed chart/chat endpoint; network-isolate or segment analytics services and block outbound egress; disable, stub, or sandbox the VannaBase.get_plotly_figure plotting path and reject untrusted prompt/parameter input; run the service as an unprivileged, containerized account without shell or command execution privileges; front exposed endpoints with a WAF/API gateway and monitor for anomalous process spawns and outbound connections; rotate any credentials or API keys accessible to affected deployments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB