Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-5565
Summary
The vanna library uses a "prompt" function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitrary Python code instead of the intended visualization code. Specifically - allowing external input to the library's "ask" method with "visualize" set to "True" (default behavior) leads to Remote Code Execution (RCE). This issue affects the package vanna versions 0.0.22 and after.
- HIGH
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-77 - Command Injection
A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.
References
Advisory Timeline
- Published
