Threats affecting pkg:github/vanna-ai/vanna

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-5321 is a medium severity vulnerability in vanna-ai vanna versions up to 2.0.2 involving a permissive cross-domain policy that allows untrusted domains. This flaw exists in an unspecified functionality of the FastAPI/Flask server component and can be exploited remotely without user interaction or privileges. The vulnerability could enable unauthorized cross-domain interactions due to improper policy restrictions. The vendor has not responded to the disclosure, and no official patch or mitigation guidance is currently available. Exploit code has been published, but no known widespread exploitation has been reported.

CVE-2026-5320 is a medium-severity vulnerability in vanna-ai vanna versions up to 2.0.2 affecting the Chat API Endpoint at /api/vanna/v2/. The issue involves missing authentication, allowing remote attackers to manipulate the endpoint without proper verification. The exploit is publicly available, but no vendor response or patch has been provided. The vulnerability has a CVSS 4.0 base score of 6.9, indicating moderate risk. No known exploits in the wild have been reported yet.

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads to injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like `/etc/passwd`, by exploiting the exposed SQL queries via a Python Flask API.

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `<?php system($_GET[0]); ?>`. This can lead to command execution or the creation of backdoors.