{"data":{"id":"c5d51efc-f8ef-4999-b0d4-e3a8ffbfe179","title":"CVE-2024-5565: The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the…","summary":"CVE-2024-5565 affects the Vanna library, which uses a prompt function to show users visualized results. Prompt injection can alter that prompt, causing arbitrary Python code to run in place of the intended visualization code. The flaw is reached through external input to the library's \"ask\" method when \"visualize\" is set to True, the default behavior, and leads to remote code execution. NVD has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-5565","publishedAt":"2024-05-31T15:15:09.673Z","cveId":"CVE-2024-5565","cweIds":["CWE-94","CWE-94"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vanna@<= 0.5.5"],"affectedPackageNames":["vanna"],"affectedPackageRefs":["pypi:vanna"],"affectedVendors":[],"affectedVendorsRaw":["Vanna"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Vanna prompt injection leads to remote code execution via ask method","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.15178,"epssCheckedAt":"2026-11-04T18:09:13.116Z","kevDateAdded":null,"advisoryAliases":["GHSA-7735-w2jp-gvg6"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:58.159Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}