Directory Traversal

Overview vanna is a Generate SQL queries from natural language Affected versions of this package are vulnerable to Directory Traversal via the FileSystemConversationStore process. An attacker can write arbitrary JSON files and read sensitive metadata from unintended locations by submitting crafte...

CVE-2026-65702: Improper Limitation of a Pathname to a Restricted Directory

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended...