CVE-2024-5565 in the critical feed json
Prompt Injection in "ask" API with visualization leads to RCE
published 2024-05-31 2 y ago modified 2026-07-01 4 mo ago also GHSA-7735-w2jp-gvg6 , PYSEC-2026-561 , EUVD-2024-1479
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.2%
- EPSS 15.2% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitrary Python code instead of the intended visualization code. Specifically - allowing external input to the library’s “ask” method with "visualize" set to True (default behavior) leads to remote code execution.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
15.18% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vanna | <=0.5.5 |
no fix listed |
Affected products
- vanna-ai vanna
Classification
References
-
research.jfrog.com
/vulnerabilities/vanna-prompt-injection-rce-jfsa-2024-001034449/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-5565
advisory
-
github.com
/vanna-ai/vanna
package
-
research.jfrog.com
/vulnerabilities/vanna-prompt-injection-rce-jfsa-2024-001034449
web
-
pypi.org
/project/vanna
package
-
github.com
/advisories/GHSA-7735-w2jp-gvg6
advisory
Sources
- CVE List CVE-2024-5565
- GitHub Advisory GHSA-7735-w2jp-gvg6
- NVD CVE-2024-5565
- OSV PYSEC-2026-561
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.