Priority HIGH 77
Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary fil…
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.0058 · Published 2026-07-23 · No fix listed CWE-22
Priority HIGH 70
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00278 · Published 2026-04-25 · No fix listed CWE-266
Priority LOW 23
A flaw has been found in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00165 · Published 2026-04-02 · No fix listed CWE-346
Priority HIGH 70
A vulnerability was detected in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00421 · Published 2026-04-02 · No fix listed CWE-287
Priority MEDIUM 57
A vulnerability was detected in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00204 · Published 2026-03-21 · No fix listed CWE-74
Priority MEDIUM 57
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00242 · Published 2026-03-21 · No fix listed CWE-707
Priority HIGH 70
A vulnerability was found in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00295 · Published 2026-03-16 · No fix listed CWE-918
Priority MEDIUM 57
A vulnerability has been found in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00204 · Published 2026-03-16 · No fix listed CWE-74
Priority HIGH 70
A flaw has been found in vanna-ai vanna up to 2.0.2.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0027 · Published 2026-03-16 · No fix listed CWE-74
Priority HIGH 70
Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests.
CVSS 3.0HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00784 · Published 2025-03-20 · No fix listed CWE-89
Priority HIGH 72
Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the `PUT` and `COPY` commands.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00662 · Published 2025-03-20 · No fix listed CWE-89
Priority MEDIUM 62
A Cross-Site Request Forgery (CSRF) vulnerability exists in the latest commit (56b782bcefd2e59b19cd7ba7878b95f54884f502) of the vanna-ai/vanna repository.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00249 · Published 2025-03-20 · No fix listed CWE-352
Priority HIGH 75
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database.
CVSS 3.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00358 · Published 2025-03-20 · No fix listed CWE-918
Priority HIGH 72
vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00604 · Published 2024-07-05 · No fix listed CWE-89
Priority HIGH 82
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03424 · Published 2024-06-28 · No fix listed CWE-89
Priority HIGH 76
In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00882 · Published 2024-06-27 · No fix listed CWE-94
THREATIST.IORead the docs