Vanna-ai vulnerable to SQL injection, allowing unauthenticated remote users to read arbitrary local files

CVE-2024-5753

What is CVE-2024-5753?

The vulnerability in Vanna version 0.3.4 allows for SQL injection attacks through specific file-critical functions, notably pg_read_file(). This weakness enables unauthenticated remote users to execute unauthorized commands that can expose sensitive local files on the server. By taking advantage of improperly sanitized SQL queries via the Python Flask API, attackers could gain access to critical files, such as user password files, leading to potential data breaches and serious security risks.

References