提交 #771214: vanna-ai Vanna 2.0.2 SQL Injection (CWE-89)

# Technical Details
A SQL Injection vulnerability exists in the `BigQuery_VectorStore.remove_training_data` method in `src/vanna/legacy/google/bigquery_vector.py` of Vanna.

The application fails to use parameterized queries when constructing a SQL DELETE statement, instead using Python f-string interpolation with user-supplied input directly.

# Vulnerable Code
File: src/vanna/legacy/google/bigquery_vector.py (line 273-282)
Method: BigQuery_VectorStore.remove_training_data
Why: The `id` parameter is interpolated directly into an f-string SQL query: `query = f"DELETE FROM {self.table_id} WHERE id = '{id}'"`. An attacker can inject arbitrary SQL via the `id` parameter.

# Reproduction
1. Deploy Vanna with BigQuery backend using default NoAuth configuration
2. Send POST request to /api/v0/remove_training_data with body: {"id": "' OR '1'='1"}
3. The injected SQL becomes: DELETE FROM `project.dataset.training_data` WHERE id = '' OR '1'='1' — deleting ALL training data

# Impact
- Mass deletion of all training data (Denial of Service)
- Selective data deletion to degrade AI output quality
- Potential data exfiltration via error-based or blind SQL injection
- Cross-table impact via BigQuery sub-queries

• 来源: ⚠️ https://gist.github.com/YLChen-007/b4f326eaecc29b192cf93dc5d6bc0623
• 用户: Eric-y (UID 95889)
• 提交: 2026-03-04 08時46分 (2 月前)
• 管理: 2026-03-15 19時45分 (11 days later)
• 状态: 已接受
• VulDB条目: 351152 [vanna-ai vanna 直到 2.0.2 bigquery_vector.py remove_training_data 标识符 SQL注入]
• 积分: 20