CVE-2024-5826 Remote Code Execution via Prompt Injection in vanna-ai/vanna
Attackers can achieve remote code execution on the backend server by exploiting prompt injection in the vanna.ask function due to lack of sandboxing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5826?
CVE-2024-5826 is a critical code injection vulnerability in vanna-ai/vanna, published on 27 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection. The root cause is the lack of a sandbox when executing LLM-generated code, allowing an attacker to manipulate the code executed by the `exec` function in `src/vanna/base/base.py`. This vulnerability can be exploited by an attacker to achieve remote code execution on the app backend server, potentially gaining full control of the server.
Weakness: CWE-94
Which versions are affected by CVE-2024-5826?
3 open source packages ship an affected version, including vanna.
| Package | Affected | Fixed in |
|---|---|---|
vanna PyPI | All versions to 0.6.2 | None |
vanna PyPI | All versions to 0.6.2 | None |
vanna PyPI | All versions to 0.6.2 | None |
How do I fix CVE-2024-5826?
No fix has been published for CVE-2024-5826 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-5826 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5826 exists.
Sources
Also known as GHSA-rrqq-fv6m-692m, PYSEC-2026-562.