PT-2026-60009 · Pypi · Vanna

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove training data of the file src/vanna/legacy/google/bigquery vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Correção

Identificadores relacionados

PYSEC-2026-3397

Produtos afetados

Vanna

Referências · 9

• https://github.com/vanna-ai/vanna · Nota
• https://pypi.org/project/vanna · Nota
• https://gist.github.com/YLChen-007/b4f326eaecc29b192cf93dc5d6bc0623 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-3397 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-4229 · Nota de Segurança
• https://vuldb.com/?ctiid.351152 · Nota
• https://vuldb.com/?id.351152 · Nota
• https://github.com/advisories/GHSA-6mj8-jmp2-g8q7 · Nota
• https://vuldb.com/?submit.771214 · Nota