PT-2024-37120

Name of the Vulnerable Software and Affected Versions: vanna-ai/vanna version v0.3.4 Description: The issue allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like /etc/passwd, by exploiting exposed SQL queries via a Python Flask API...

CVE-2024-5753: Improper Neutralization of Special Elements used in an SQL Command

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as pgreadfile. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like /etc/passwd, by exploiting the exposed SQL...

Vanna Information Disclosure Vulnerability

Vanna is a personalized AI SQL agent from Vanna. An information disclosure vulnerability exists in v0.3.4 of vanna, which stems from the vulnerability of certain file-related functions to SQL injection attacks. An unauthenticated, remote attacker exploiting this vulnerability could read arbitrary...