| Titre | vanna-ai Vanna 2.0.2 SQL Injection (CWE-89) |
|---|
| Description | # Technical Details
A SQL Injection vulnerability exists in the `BigQuery_VectorStore.remove_training_data` method in `src/vanna/legacy/google/bigquery_vector.py` of Vanna.
The application fails to use parameterized queries when constructing a SQL DELETE statement, instead using Python f-string interpolation with user-supplied input directly.
# Vulnerable Code
File: src/vanna/legacy/google/bigquery_vector.py (line 273-282)
Method: BigQuery_VectorStore.remove_training_data
Why: The `id` parameter is interpolated directly into an f-string SQL query: `query = f"DELETE FROM {self.table_id} WHERE id = '{id}'"`. An attacker can inject arbitrary SQL via the `id` parameter.
# Reproduction
1. Deploy Vanna with BigQuery backend using default NoAuth configuration
2. Send POST request to /api/v0/remove_training_data with body: {"id": "' OR '1'='1"}
3. The injected SQL becomes: DELETE FROM `project.dataset.training_data` WHERE id = '' OR '1'='1' — deleting ALL training data
# Impact
- Mass deletion of all training data (Denial of Service)
- Selective data deletion to degrade AI output quality
- Potential data exfiltration via error-based or blind SQL injection
- Cross-table impact via BigQuery sub-queries |
|---|
| La source | ⚠️ https://gist.github.com/YLChen-007/b4f326eaecc29b192cf93dc5d6bc0623 |
|---|
| Utilisateur | Eric-y (UID 95889) |
|---|
| Soumission | 04/03/2026 08:46 (il y a 2 mois) |
|---|
| Modérer | 15/03/2026 19:45 (11 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 351152 [vanna-ai vanna jusqu’à 2.0.2 bigquery_vector.py remove_training_data ID injection SQL] |
|---|
| Points | 20 |
|---|