| शीर्षक | vanna.ai vanna 2.0.2 SQL Injection |
|---|
| विवरण | Vanna utilizes large language models to understand user intents and generate SQL, enabling users to interact with databases using natural language. However, Vanna executes all SQL statements generated by the LLM without filtration. Malicious users may control the model’s output through prompt injection, leading to arbitrary SQL execution. While this may be an intentional design choice of Vanna, due to the powerful features of Oracle databases, allowing arbitrary SQL execution could enable attackers to run arbitrary commands on the target server, resulting in full server compromise. |
|---|
| स्रोत | ⚠️ https://github.com/Ka7arotto/cve/blob/main/vanna-text2sql/vanna-sql-rce.md |
|---|
| उपयोगकर्ता | Goku (UID 80486) |
|---|
| सबमिशन | 06/03/2026 12:48 PM (7 महीनों पहले) |
|---|
| संयम | 20/03/2026 03:28 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 352078 [vanna-ai vanna तक 2.0.2 base.py ask SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|