PT-2026-29680
CVE-2026-5321
·
Published
2026-04-02
·
Updated
2026-04-02
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions
vanna-ai vanna versions up to 2.0.2
Description
A flaw exists in the FastAPI/Flask Server component of vanna-ai vanna. A manipulation can lead to a permissive cross-domain policy with untrusted domains, allowing for remote attacks. The exploit has been published.
Recommendations
Update vanna-ai vanna to a version later than 2.0.2.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾