Approved changes feed: RSS · Atom
cpe:2.3:a:vanna-ai:vanna:0.3.4:*:*:*:*:*:*:*part: a version: 0.3.4 update: *
| Vendor | Vanna Ai (0da1831f-5be4-5a92-80be-0f2b1ea93d9c) |
|---|---|
| Product | Vanna (3d7c4586-0626-51f4-a04a-e35dab6107cc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-5827 |
vulnerable | 2026-06-08 06:56:17.506111 |
Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
CRITICAL (9.8)
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `<?php system($_GET[0]); ?>`. This can lead to command execution or the creation of backdoors.
Published: 2024-06-28T19:27:33.049Z
Updated: 2025-10-15T12:50:30.543Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5753 |
vulnerable | 2026-06-08 06:56:17.279297 |
Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna
HIGH (7.5)
vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like `/etc/passwd`, by exploiting the exposed SQL queries via a Python Flask API.
Published: 2024-07-05T19:27:22.046Z
Updated: 2025-10-15T12:50:29.242Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.