CVE-2024-6841 - CVE House
Back to Database
Status published Medium CVE-2024-6841

CSRF in vanna-ai/vanna

Vulnerability Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the latest commit (56b782bcefd2e59b19cd7ba7878b95f54884f502) of the vanna-ai/vanna repository. Two endpoints in the built-in web app that provide SQL functionality are implemented as simple GET requests, making them susceptible to CSRF attacks. This vulnerability allows an attacker to run arbitrary SQL commands via CSRF without the target intending to expose the web app to the network or other users. The impact is limited to data alteration or deletion, as the attacker cannot read the results of the query.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6841

Credits & Attribution

No credits recorded in the NVD database.

References

More from vanna-ai

View All →
CVE-2024-8099
Server-Side Request Forgery (SSRF) in vanna-ai/vanna
High 8.3
CVE-2024-8055
Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna
High 7.5
CVE-2024-7764
SQL Injection in vanna-ai/vanna
High 8.1
CVE-2024-5827
Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
Critical 9.8
CVE-2024-5826
Remote Code Execution via Prompt Injection in vanna-ai/vanna
Critical 9.8

Affected Vendor

Affected Software

vanna-ai/vanna
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact