← CVE Intelligence

CVE-2024-5753

Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna PUBLISHED

Description (CNA)

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like `/etc/passwd`, by exploiting the exposed SQL queries via a Python Flask API.

Affected (CNA)

Vendor / productVersions
vanna-ai / vanna-ai/vannaaffected unspecified through latest

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.