Vanna.AI ask() prompt-injection -> exec() RCE
Date: 2024-06
Affected: vanna-ai/vanna
Attack vector: prompt-injection
Category: real-world
Severity: Critical
CVE: CVE-2024-5826
CWE: CWE-94
CVSS: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Latest version of vanna-ai/vanna's vanna.ask() function is vulnerable to RCE due to prompt injection that manipulates LLM-generated code subsequently executed without sandboxing via exec() in src/vanna/base/base.py. CVSS 9.8.


Mitigations:

Architectural layers (MAESTRO):