CyberRota Analysis
AI-GeneratedVanna v2.0.2 has a code injection vulnerability in the VannaBase.get_plotly_figure function, allowing attackers to execute arbitrary code or commands if they can access the affected entry point. Organizations using this version of Vanna should prioritize remediation efforts to mitigate the risk of unauthorized code execution. Immediate attention is recommended for environments where this software is deployed, especially those exposed to untrusted inputs.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.