Vanna-ai vulnerabilities

Products

• Vanna 13
• Vanna-ai/vanna 7

Newest

• vanna-ai vanna Vanna 2.0.2 Path Traversal via FileSystemConversationStore CVE-2026-65702 8.8 HighJuly 23, 2026
• vanna-ai vanna vanna-ai vanna Legacy Flask API improper authorization CVE-2026-6977 6.9 MediumApril 25, 2026
• vanna-ai vanna vanna-ai vanna FastAPI/Flask Server cross-domain policy CVE-2026-5321 5.3 MediumApril 2, 2026
• vanna-ai vanna vanna-ai vanna Chat API Endpoint v2 missing authentication CVE-2026-5320 6.9 MediumApril 2, 2026
• vanna-ai vanna vanna-ai vanna base.py ask sql injection CVE-2026-4513 5.3 MediumMarch 21, 2026
• vanna-ai vanna vanna-ai vanna legacy exec injection CVE-2026-4511 5.3 MediumMarch 21, 2026
• vanna-ai vanna vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery CVE-2026-4231 6.9 MediumMarch 16, 2026
• vanna-ai vanna vanna-ai vanna Endpoint __init__.py update_sql sql injection CVE-2026-4230 5.3 MediumMarch 16, 2026
• vanna-ai vanna vanna-ai vanna bigquery_vector.py remove_training_data sql injection CVE-2026-4229 6.9 MediumMarch 16, 2026
• vanna-ai vanna-ai/vanna SQL Injection in vanna-ai/vanna CVE-2024-7764 8.1 HighMarch 20, 2025
• vanna-ai vanna-ai/vanna Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna CVE-2024-8055 7.5 HighMarch 20, 2025
• vanna-ai vanna-ai/vanna CSRF in vanna-ai/vanna CVE-2024-6841 6.5 MediumMarch 20, 2025
• vanna-ai vanna-ai/vanna Server-Side Request Forgery (SSRF) in vanna-ai/vanna CVE-2024-8099 8.3 HighMarch 20, 2025
• vanna-ai vanna, vanna-ai/vanna +1 more Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna CVE-2024-5753 7.5 HighJuly 5, 2024
• vanna-ai vanna, vanna-ai/vanna +1 more Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna CVE-2024-5827 9.8 CriticalJune 28, 2024
• vanna-ai vanna, vanna-ai/vanna +1 more Remote Code Execution via Prompt Injection in vanna-ai/vanna CVE-2024-5826 9.8 CriticalJune 27, 2024
• vanna-ai vanna Prompt Injection in "ask" API with visualization leads to RCE CVE-2024-5565 EPSS 15.2% 8.1 HighMay 31, 2024