Skip to contentVanna-ai Vanna vulnerabilities
- vanna-ai vannaVanna 2.0.2 Path Traversal via FileSystemConversationStoreCVE-2026-657028.8 High
- vanna-ai vannavanna-ai vanna Legacy Flask API improper authorizationCVE-2026-69776.9 Medium
- vanna-ai vannavanna-ai vanna FastAPI/Flask Server cross-domain policyCVE-2026-53215.3 Medium
- vanna-ai vannavanna-ai vanna Chat API Endpoint v2 missing authenticationCVE-2026-53206.9 Medium
- vanna-ai vannavanna-ai vanna base.py ask sql injectionCVE-2026-45135.3 Medium
- vanna-ai vannavanna-ai vanna legacy exec injectionCVE-2026-45115.3 Medium
- vanna-ai vannavanna-ai vanna Endpoint __init__.py run_sql server-side request forgeryCVE-2026-42316.9 Medium
- vanna-ai vannavanna-ai vanna Endpoint __init__.py update_sql sql injectionCVE-2026-42305.3 Medium
- vanna-ai vannavanna-ai vanna bigquery_vector.py remove_training_data sql injectionCVE-2026-42296.9 Medium
- vanna-ai vanna-ai/vannaSQL Injection in vanna-ai/vannaCVE-2024-77648.1 High
- vanna-ai vanna-ai/vannaLocal File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vannaCVE-2024-80557.5 High
- vanna-ai vanna-ai/vannaCSRF in vanna-ai/vannaCVE-2024-68416.5 Medium
- vanna-ai vanna-ai/vannaServer-Side Request Forgery (SSRF) in vanna-ai/vannaCVE-2024-80998.3 High
- vanna-ai vanna, vanna-ai/vanna +1 moreLocal File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vannaCVE-2024-57537.5 High
- vanna-ai vanna, vanna-ai/vanna +1 moreArbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vannaCVE-2024-58279.8 Critical
- vanna-ai vanna, vanna-ai/vanna +1 moreRemote Code Execution via Prompt Injection in vanna-ai/vannaCVE-2024-58269.8 Critical
- vanna-ai vannaPrompt Injection in "ask" API with visualization leads to RCECVE-2024-5565EPSS 15.2%8.1 High