Vanna text-to-SQL library lets prompt injection turn chart generation into remote code execution

Vanna AI·Vanna (vanna-ai/vanna) text-to-SQL agent libraryUnresolved

Vanna's 'ask' method, run with its default 'visualize=True' setting, passes LLM-generated Python plotting code straight through for execution; JFrog researchers showed that a crafted natural-language prompt to 'ask' could override the system instructions and make the library execute arbitrary attacker-supplied Python instead of chart code, demonstrated live against Vanna's own public Colab demo connected to a Chinook SQLite database.

Blast radius

No named victim breach was disclosed, but JFrog demonstrated full arbitrary code execution (PoC ran an OS command) on Vanna's own demo notebook; every published version of the library (0.0.1 through 0.5.5) is listed as affected, and GitHub's advisory records no patched release, so any deployment that calls ask() with untrusted input and the default visualize=True remains exploitable.

Root cause

The library treats LLM output as trusted code rather than data, feeding model-generated 'visualization' Python to an execution sink with no sandboxing, so any prompt injection that reaches the ask() call becomes remote code execution.

How it was caught

Found by JFrog Security Research (Natan Nehorai) through responsible disclosure with a working proof-of-concept against Vanna's public demo, not through Vanna's own testing or a reported live-production incident.

What changed

No patched version exists as of the advisory (GitHub lists 'Patched versions: None'); the only published mitigation is to set visualize=False whenever untrusted input reaches ask(), which closes the vulnerable path but disables the visualization feature entirely.

Take-awayAny agent feature that turns LLM output into 'generate code, then execute it' is a remote-code-execution surface — sandbox or remove that path before trusting it on untrusted input.