Back to Database
Status published
Critical
CVE-2024-5827
Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
Vulnerability Description
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `<?php system($_GET[0]); ?>`. This can lead to command execution or the creation of backdoors.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5827
Credits & Attribution
No credits recorded in the NVD database.
More from vanna-ai
View All →CVE-2024-8099
Server-Side Request Forgery (SSRF) in vanna-ai/vanna
High
8.3
CVE-2024-8055
Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna
High
7.5
CVE-2024-7764
SQL Injection in vanna-ai/vanna
High
8.1
CVE-2024-6841
CSRF in vanna-ai/vanna
Medium
6.5
CVE-2024-5826
Remote Code Execution via Prompt Injection in vanna-ai/vanna
Critical
9.8
Affected Vendor
vanna-ai
View all reports →Affected Software
vanna-ai/vanna
Vulnerable Versions:
unspecified
Timeline
Official Publish:
June 28th, 2024
Last Modified:
October 15th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H