What’s Vulnerable › Products

vanna-ai vanna vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your vanna-ai vanna version is affected

Latest vanna-ai vanna vulnerabilities

• CVE-2026-65702 — Vanna 2.0.2 Path Traversal via FileSystemConversationStore (CVSS 8.6)
• CVE-2026-6977 — vanna-ai vanna Legacy Flask API improper authorization (CVSS 7.3)
• CVE-2026-5321 — vanna-ai vanna FastAPI/Flask Server cross-domain policy (CVSS 4.3)
• CVE-2026-5320 — vanna-ai vanna Chat API Endpoint v2 missing authentication (CVSS 7.3)
• CVE-2026-4513 — vanna-ai vanna base.py ask sql injection (CVSS 6.3)
• CVE-2026-4511 — vanna-ai vanna legacy exec injection (CVSS 6.3)
• CVE-2026-4231 — vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery (CVSS 7.3)
• CVE-2026-4230 — vanna-ai vanna Endpoint __init__.py update_sql sql injection (CVSS 6.3)
• CVE-2026-4229 — vanna-ai vanna bigquery_vector.py remove_training_data sql injection (CVSS 7.3)
• CVE-2024-5753 — Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna (CVSS 7.5)
• CVE-2024-5827 — Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna (CVSS 9.8)
• CVE-2024-5826 — Remote Code Execution via Prompt Injection in vanna-ai/vanna (CVSS 9.8)
• CVE-2024-5565 — Prompt Injection in "ask" API with visualization leads to RCE (CVSS 8.1)