Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview vanna is a Generate SQL queries from natural language Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the exec function in the /src/vanna/legacy file. An attacker can execute arbitrar...

CVE-2026-4511

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads to injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early...

CVE-2026-4511 vanna-ai vanna legacy exec injection

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads to injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early...

CVE-2026-4511

CVE-2026-4511 affects vanna-ai up to version 2.0.2. The vulnerability targets the function exec in the file /src/vanna/legacy, enabling injection due to an underlying manipulation. The issue is exploitable remotely and has publicly disclosed exploit materials. Multiple CVE references corroborate ...