CVE-2024-5826: RCE in vanna-ai/vanna

The vulnerability lies within the vanna.ask function, where the absence of a sandbox allows attackers to inject malicious prompts. These prompts can manipulate the exec function in src/vanna/base/base.py, leading to the execution of arbitrary code on the application's backend server. Successful exploitation grants an attacker complete control over the server, enabling them to steal sensitive data, install malware, or disrupt operations. The potential impact is severe, as the attacker effectively becomes a root user on the affected system. This vulnerability shares similarities with other prompt injection attacks targeting LLM-powered applications, highlighting the importance of robust input validation and sandboxing.

1. Reserved2024-06-10
2. Published2024-06-27
3. Modified2025-10-15
4. EPSS updated2026-04-02

Currently, a direct patch is not available. Until a fix is released, the primary mitigation strategy is to restrict access to the vanna.ask function and carefully validate all user inputs. Implement strict input sanitization and filtering to prevent malicious prompts from being processed. Consider using a Web Application Firewall (WAF) with prompt injection detection rules to block suspicious requests. Monitor system logs for unusual activity or attempts to execute commands. Once a patched version of vanna-ai/vanna is released, upgrade immediately. After upgrade, confirm by attempting a controlled prompt injection test to verify the vulnerability is resolved.