CVE-2024-5753: Vanna-Ai Vanna

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as `pg_read_file()`. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like `/etc/passwd`, by exploiting the exposed SQL queries via a Python Flask API.

Affected products

• Vanna-Ai Vanna: version 0.3.4 only
• Vanna-Ai Vanna-Ai/vanna: affected versions not specified

Published 2024-07-05. Last modified 2026-06-17.