Vanna-ai vulnerabilities
We track 12 vulnerabilities in Vanna-ai products across 2 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest Vanna-ai vulnerabilities
- 8.6 High severity
vanna: Improper Limitation of a Pathname to a Restricted Directory
Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation
- 7.3 High severity
vanna: Incorrect Privilege Assignment
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The explo
- 7.3 High severity
vanna: Improper Authentication
A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the component Chat API Endpoint. Performing a manipulation results in missing authentication. The attack can be
- 7.3 High severity
vanna: Server-Side Request Forgery
A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_sql of the file src/vanna/legacy/flask/__init__.py of the component Endpoint. Performing a manipulation results in server-side request forger
- 7.3 High severity
vanna: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigquery_vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exp
- 8.3 High severity
vanna-ai/vanna: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as `
- 7.5 High severity
vanna-ai/vanna: Improper Neutralization of Special Elements used in an SQL Command
Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the `PUT` and `COPY` commands. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, such as `/etc/pass
- 8.1 High severity
vanna-ai/vanna: Improper Neutralization of Special Elements used in an SQL Command
Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests. The vulnerability occurs when the `generate_sql` function calls `extract_sql` with the LLM response. An attacker can inc
- 7.5 High severity
vanna-ai/vanna: Improper Neutralization of Special Elements used in an SQL Command
vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like `/e
- 9.8 Critical severity
vanna-ai/vanna: Improper Neutralization of Special Elements used in an SQL Command
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php
- 9.8 Critical severity
vanna-ai/vanna: Improper Control of Generation of Code
In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection. The root cause is the lack of a sandbox when executing LLM-generated code, allowing an attacker to manipulate the code executed by
- 8.1 High severity
vanna: Improper Control of Generation of Code
The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitrary Python code instead of the intended visualization code. Specifically - allowing external input to