An unauthenticated remote attacker can exploit a Server-Side Request Forgery and Local File Inclusion vulnerability in vanna-ai vanna to read arbitrary files or conduct internal network reconnaissance.

The vulnerability arises from unrestricted SQL injection via the /api/v0/update_sql endpoint, which allows an unauthenticated attacker to execute malicious SELECT statements containing DuckDB functions. These functions, such as read_text and read_blob, can be leveraged to read sensitive local files or perform unauthorized HTTP requests.

The ability to perform Local File Inclusion (LFI) poses a severe risk, as attackers may extract sensitive configuration files, credentials, or system data from the host environment. Furthermore, the Server-Side Request Forgery (SSRF) capability allows attackers to bypass network perimeters and interact with internal services that are not exposed to the public internet. Given the CVSS score of 7.3, this vulnerability represents a high-risk entry point for further compromise of the infrastructure.

Immediate Action: There is currently no official patch available; users should immediately restrict access to the Flask API endpoints or disable the vanna service until a secure update is provided.

Proactive Monitoring: Review web access logs for unusual POST requests to /api/v0/update_sql and GET requests to /api/v0/run_sql that contain SQL keywords like read_csv or read_text.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or inspect incoming traffic to the /api/v0/ endpoints for malicious SQL patterns, specifically targeting DuckDB-specific function calls.

Public Exploit Available: Yes — a public proof-of-concept and technical write-up are available on GitHub via the referenced research gist.

Given the availability of a functional proof-of-concept and the high impact of arbitrary file access, this vulnerability must be treated with urgency. Security teams should prioritize isolating affected Vanna instances from the network and restricting API access to trusted internal sources only. Monitor vendor channels closely for the release of a security patch and apply it immediately upon availability.