CVE-2026-51911 in vanna
Summary
by MITRE • 10/02/2026
vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The identified security flaw resides within version 2.0.2 of the Vanna library, specifically targeting the get_plotly_figure method in the src/vanna/legacy/base/base.py module. This vulnerability represents a critical instance of server-side code injection, where the application fails to adequately sanitize or validate user-supplied input before processing it for visualization generation. The core technical issue stems from the improper handling of dynamic content within the plotting engine, allowing an attacker who has access to specific exposed entry points to inject malicious payloads directly into the execution context of the Python interpreter. This lack of strict input validation creates a direct pathway for arbitrary code execution, bypassing standard security controls that would typically isolate such operations.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration CWE-94, which describes Improper Control of Generation of Code or Command known as Injection. The attacker leverages the flexibility of the plotting library to execute unintended commands by manipulating parameters passed to the get_plotly_figure function. Because Vanna is often used in data analysis and machine learning workflows where user inputs are common, this flaw poses a significant risk if the service is exposed over a network or integrated into an application that accepts untrusted data for visualization purposes. The ability to trigger arbitrary code execution means that a successful exploit could lead to complete compromise of the underlying system hosting the Vanna instance.
The operational impact of this vulnerability extends far beyond simple data corruption or denial of service. An attacker with sufficient privileges can achieve remote code execution, potentially gaining control over the server environment. This level of access allows for further lateral movement within a network, exfiltration of sensitive data stored on the host system, and establishment of persistent backdoors. In cloud-native environments, this could lead to compromise of containerized workloads or underlying infrastructure if not properly isolated. The severity is heightened by the fact that many organizations rely on Vanna for automated reporting and dashboard generation, making it a frequent target for attackers seeking initial access through data processing pipelines.
To mitigate this risk, immediate action should be taken to upgrade to a patched version of Vanna where input sanitization has been rigorously implemented within the get_plotly_figure method. Organizations running vulnerable versions must restrict network exposure of any endpoints that utilize this function, ensuring they are not accessible from untrusted networks or public internet interfaces until an update is applied. Additionally, implementing strict allow-listing for inputs and employing runtime application self-protection tools can help detect anomalous behavior indicative of code injection attempts. Security teams should also review their deployment configurations to ensure least privilege principles are enforced, limiting the potential blast radius in case a successful exploitation occurs. This incident underscores the importance of rigorous input validation in libraries that handle dynamic content generation, particularly those integrated into broader data science ecosystems as referenced by MITRE ATT&CK techniques related to command and script interpretation.