CVE-2026-4230 | vanna-ai vanna up to 2.0.2 Endpoint __init__.py update_sql sql injection

SecurityVulns
Yanac

A vulnerability was found in vanna-ai vanna up to 2.0.2 and classified as critical. Affected is the function update_sql of the file src/vanna/legacy/flask/__init__.py of the component Endpoint. Such manipulation leads to sql injection.

This vulnerability is uniquely identified as CVE-2026-4230. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More