PT-2024-36568

CVE-2024-5565

Published

2024-05-31

Updated

2026-06-29

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vanna library (affected versions not specified)

Description The Vanna library is affected by a remote code execution issue due to prompt injection. This allows an attacker to alter the prompt function used for visualized results and run arbitrary Python code. The issue arises when external input is allowed to the library's ask method with visualize set to True, which is the default behavior. This vulnerability has been reportedly exploited in the wild.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Natan Nehorai

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers

CVE-2024-5565

GHSA-7735-W2JP-GVG6