Vanna AI's exec()-based SQL agent lets prompt injection reach full remote code execution

vanna-ai·Vanna (vanna-ai/vanna text-to-SQL agent, the vanna.ask() pipeline)Unresolved

Vanna's vanna.ask() function takes the code an LLM generates in response to a user's natural-language question and runs it straight through Python's exec() with no sandbox, so an attacker who can influence the prompt (e.g. via a crafted question or injected data) can make the model emit arbitrary Python that then executes on the backend server.

Blast radius

Any application built on vanna versions up to and including 0.6.2 could have its backend server fully compromised by a remote, unauthenticated attacker with no user interaction required; the flaw was rated CVSS 3.0 9.8 (Confidentiality/Integrity/Availability all High). No specific breached deployer, user count, or dollar loss is disclosed in the advisory.

Root cause

LLM-generated code was passed directly into Python's exec() without sandboxing, input validation, or least-privilege isolation, so any code the model could be induced to write ran with the full privileges of the host application.

How it was caught

Found by a security researcher and reported through the huntr AI/ML bug-bounty platform rather than being caught internally by the vanna maintainers or a deployer in production.

Take-awayNever feed LLM-generated code straight into exec()/eval(); run any agent-produced code in an isolated, least-privilege sandbox and treat model output as untrusted input.