通过 Prompt Injection 在 vanna-ai/vanna 中实现远程代码执行

The vulnerability lies within the vanna.ask function, where the absence of a sandbox allows attackers to inject malicious prompts. These prompts can manipulate the exec function in src/vanna/base/base.py, leading to the execution of arbitrary code on the application's backend server. Successful exploitation grants an attacker complete control over the server, enabling them to steal sensitive data, install malware, or disrupt operations. The potential impact is severe, as the attacker effectively becomes a root user on the affected system. This vulnerability shares similarities with other prompt injection attacks targeting LLM-powered applications, highlighting the importance of robust input validation and sandboxing.

Organizations and individuals deploying vanna-ai/vanna in production environments are at significant risk. This includes developers integrating vanna-ai/vanna into their applications, as well as users who rely on vanna-ai/vanna for LLM-powered tasks. The vulnerability's ease of exploitation makes it a target for both opportunistic attackers and those with more sophisticated capabilities.

• python / server: Monitor system logs for suspicious process executions, particularly those involving shell commands or external programs. Look for unusual network connections originating from the vanna-ai/vanna application directory.

ps aux | grep 'vanna.ask' | grep -v grep

• generic web: Examine access logs for requests containing unusual or unexpected characters within the prompt parameters. Use a WAF to detect and block requests with suspicious patterns.

grep -i 'malicious_prompt' /var/log/apache2/access.log

1. 2024-06-27Disclosure

   disclosure

1. 已保留2024-06-10
2. 发布日期2024-06-27
3. 修改日期2025-10-15
4. EPSS 更新日期2026-04-02

Currently, a direct patch is not available. Until a fix is released, the primary mitigation strategy is to restrict access to the vanna.ask function and carefully validate all user inputs. Implement strict input sanitization and filtering to prevent malicious prompts from being processed. Consider using a Web Application Firewall (WAF) with prompt injection detection rules to block suspicious requests. Monitor system logs for unusual activity or attempts to execute commands. Once a patched version of vanna-ai/vanna is released, upgrade immediately. After upgrade, confirm by attempting a controlled prompt injection test to verify the vulnerability is resolved.