CVE-2024-5827
Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- June 10, 2024
- Published Date
- June 28, 2024
- Last Updated
- August 01, 2024
- Vendor
- vanna-ai
- Product
- vanna-ai/vanna
- Description
- Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents ``. This can lead to command execution or the creation of backdoors.
- Tags
- Score
- 46.23% (Percentile: 97.48%) as of 2025-06-09
- Exploitation
- poc
- Automatable
- Yes
- Technical Impact
- total
- Exploited in the Wild
- Yes (2025-05-12 00:00:00 UTC) Source
php
nuclei_scanner
CVSS Scores
CVSS v3.0
9.8 - CRITICAL
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
SSVC Information
Exploit Status
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| The Shadowserver (via CIRCL) | 2025-05-12 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5827.yaml | 2025-04-26 00:00:00 UTC |
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Detected by Nuclei
-
Added to KEVIntel