| Titel | vanna-ai Vanna 2.0.2 SQL Injection (CWE-89) |
|---|
| Beschreibung | # Technical Details
A SQL Injection vulnerability exists in the `BigQuery_VectorStore.remove_training_data` method in `src/vanna/legacy/google/bigquery_vector.py` of Vanna.
The application fails to use parameterized queries when constructing a SQL DELETE statement, instead using Python f-string interpolation with user-supplied input directly.
# Vulnerable Code
File: src/vanna/legacy/google/bigquery_vector.py (line 273-282)
Method: BigQuery_VectorStore.remove_training_data
Why: The `id` parameter is interpolated directly into an f-string SQL query: `query = f"DELETE FROM {self.table_id} WHERE id = '{id}'"`. An attacker can inject arbitrary SQL via the `id` parameter.
# Reproduction
1. Deploy Vanna with BigQuery backend using default NoAuth configuration
2. Send POST request to /api/v0/remove_training_data with body: {"id": "' OR '1'='1"}
3. The injected SQL becomes: DELETE FROM `project.dataset.training_data` WHERE id = '' OR '1'='1' — deleting ALL training data
# Impact
- Mass deletion of all training data (Denial of Service)
- Selective data deletion to degrade AI output quality
- Potential data exfiltration via error-based or blind SQL injection
- Cross-table impact via BigQuery sub-queries |
|---|
| Quelle | ⚠️ https://gist.github.com/YLChen-007/b4f326eaecc29b192cf93dc5d6bc0623 |
|---|
| Benutzer | Eric-y (UID 95889) |
|---|
| Einreichung | 04.03.2026 08:46 (vor 2 Monaten) |
|---|
| Moderieren | 15.03.2026 19:45 (11 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 351152 [vanna-ai vanna bis 2.0.2 bigquery_vector.py remove_training_data ID SQL Injection] |
|---|
| Punkte | 20 |
|---|