A critical SQL injection vulnerability in vanna-ai vanna (versions 2.0.0 through 2.0.2) allows unauthenticated remote attackers to perform unauthorized database operations, including mass data deletion.

The vulnerability exists in the remove_training_data function within src/vanna/legacy/google/bigquery_vector.py, where user-supplied input is interpolated directly into a SQL DELETE statement without sanitization. Due to the default NoAuth configuration, the API endpoint is accessible to unauthenticated attackers, allowing them to inject arbitrary SQL commands via the id parameter.

Successful exploitation allows an attacker to manipulate or delete training data stored in BigQuery, leading to significant data loss and potential service disruption. Given the CVSS score of 7.3, this vulnerability poses a high risk to data integrity and availability, as the flaw is remotely exploitable without requiring any authentication.

Immediate Action: As no official patch is currently available, users should immediately restrict network access to the vanna API endpoint and implement strict authentication controls to override the vulnerable default NoAuth configuration.

Proactive Monitoring: Monitor database query logs for unusual DELETE operations or patterns indicative of SQL injection, such as the inclusion of OR clauses or unexpected characters in API requests to the remove_training_data endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the /api/v0/remove_training_data endpoint.

Public Exploit Available: Yes, a technical write-up containing attack details and a proof-of-concept for the SQL injection has been published on GitHub.

This vulnerability represents a significant risk to data integrity due to the ease of exploitation. Administrators must prioritize isolating the affected service from public networks and ensure that custom authentication mechanisms are implemented to replace the insecure default configuration until an official vendor patch is released.