CVE-2024-7764

Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests. The vulnerability occurs when the "generatesql" function calls "extractsql" with the LLM response. An attacker can include a semi-colon between a search data...