CVE-2024-5826: vanna-ai/vanna remote code execution through prompt injection in vanna.ask

Summary

CVE-2024-5826 affects the latest version of vanna-ai/vanna. The vanna.ask function lacks a sandbox when executing LLM-generated code, so a prompt injection can alter the code run by the exec function in src/vanna/base/base.py. An attacker can use this to achieve remote code execution on the app backend server and potentially gain full control of it. The weakness is classified as CWE-94, Improper Control of Generation of Code ('Code Injection').

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• vannaPyPILLM dependency since 2023-08-31

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)