CVE-2024-7764

Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests. The vulnerability occurs when the generatesql function calls extractsql with the LLM response. An attacker can include a semi-colon between a search data fie...

CVE-2024-7764

Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection when generate_sql calls extract_sql on the LLM response. An attacker can insert a semicolon between a data field and their own command, causing extract_sql to remove LLM-generated SQL and execute the attacker’s command ...

PT-2025-12187

Name of the Vulnerable Software and Affected Versions Vanna-ai version 0.6.2 Description The issue arises from insufficient protection against injecting additional SQL commands from user requests. This occurs when the generate sql function calls extract sql with the LLM response. An attacker can...

CVE-2024-7764: Improper Neutralization of Special Elements used in an SQL Command

Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests. The vulnerability occurs when the generatesql function calls extractsql with the LLM response. An attacker can include a semi-colon between a search data fie...