YLChen-007

#!/usr/bin/env python3
"""
PoC: Grok Unbounded Recursion DoS via Simulate Pipeline API
Requires ONLY read_pipeline privilege (NOT manage_pipeline)

Demonstrates that a non-admin user can crash an Elasticsearch node
through the simulate pipeline endpoint.

Usage:
  1. Start ES with security: see REBUTTAL.md Step 1

YLChen-007

Description:

Summary

A Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) vulnerability exists in vanna-ai/vanna when using DuckDB as the database backend. An unauthenticated attacker can inject arbitrary SQL containing DuckDB's built-in file/HTTP functions (read_csv, read_csv_auto, read_text, read_blob) via the /api/v0/update_sql endpoint, and then trigger execution via /api/v0/run_sql. This causes the server to make HTTP requests to attacker-controlled or internal URLs (SSRF), or read arbitrary local files (LFI) and return the contents to the attacker.

The vulnerability requires no authentication (default NoAuth), no special privileges, and no user interaction. All malicious payloads are valid SELECT statements that bypass Vanna's is_sql_valid() check.

Details

YLChen-007

Summary

The LocalPythonExecutor sandbox in smolagents can be escaped to achieve Remote Code Execution (RCE). The fix for CVE-2025-9959 added dunder method call checks in evaluate_call, but the evaluate_with function calls __enter__() and __exit__() directly on context manager objects using Python's native method calling, completely bypassing evaluate_call. A user-defined class with a malicious __enter__ method can escape the sandbox when used in a with statement.

Details

CVE-2025-9959 added a dunder call check in evaluate_call (lines 910-917):

if (

YLChen-007

Description:

Summary

The LocalPythonExecutor sandbox in smolagents can be escaped to achieve Remote Code Execution (RCE). The fix for CVE-2025-9959 explicitly allows __init__, __str__, and __repr__ dunder methods to be called via the ALLOWED_DUNDER_METHODS allowlist. However, user-defined classes can implement malicious __str__ or __repr__ methods that perform sandbox escape. Calling str() on such an object — which is freely available in the sandbox — triggers the malicious method and achieves RCE.

Details

CVE-2025-9959 introduced ALLOWED_DUNDER_METHODS at line 61 to allow commonly-needed dunder methods:

YLChen-007

Description:

Summary

The LocalPythonExecutor sandbox in smolagents can be escaped to achieve Remote Code Execution (RCE). The fix for CVE-2025-9959 added dunder attribute access checks in evaluate_attribute, but the evaluate_augassign function has a separate attribute reading path (get_current_value) that uses raw getattr() without any dunder check. An attacker can read protected dunder attributes like __code__ through augmented assignment operations (e.g., obj.__code__ += trap), then overwrite function bytecode to execute arbitrary commands on the host.

Details

CVE-2025-9959 added a dunder attribute access block in evaluate_attribute (line 390):

YLChen-007

Summary

The /api/v0/update_sql endpoint accepts arbitrary SQL from the request body and stores it in the shared cache with zero validation. An attacker then calls /api/v0/run_sql with the same cache ID, which reads the cached SQL and executes it directly against the connected database — again with zero validation. This completely bypasses the is_sql_valid() check that only exists in the generate_sql endpoint, allowing unrestricted SQL execution including DROP TABLE, credential theft, and on non-SQLite backends, arbitrary file read (pg_read_file) or RCE (xp_cmdshell). The default NoAuth configuration means no authentication is required.

This is a more severe variant of CVE-2024-7764 (extract_sql bypass) and CVE-2024-8055 (Snowflake file read), because it requires no LLM manipulation, no regex bypass, works across all database backends, and is 100% deterministic.

Details

The vulnerability exists because update_sql and run_sql share the same cache, but only generate_sql has

YLChen-007

Description:

Summary

Vanna AI has zero SQL validation on LLM-generated queries before execution. An unauthenticated attacker can inject malicious question→SQL training data via POST /api/v0/train, then ask a semantically similar question via GET /api/v0/generate_sql to make the LLM reproduce the malicious SQL. The generated SQL is then executed directly on the connected database via GET /api/v0/run_sql — without any sanitization, query type restriction, or dangerous function blocking. This affects all 11 database backends (PostgreSQL, DuckDB, MySQL, SQLite, MSSQL, Oracle, BigQuery, Snowflake, ClickHouse, Presto, Hive).

This is a variant of CVE-2024-5753 (PostgreSQL pg_read_file) and CVE-2024-5827 (DuckDB file write), but demonstrates that the root cause — complete absence of SQL validation — has never been fixed and affects every backend.

Details

YLChen-007

Description:

Summary

The BigQuery vector store backend (bigquery_vector.py) constructs a SQL DELETE statement using Python f-string interpolation with user-supplied input, without any parameterization or sanitization. An unauthenticated attacker (under the default NoAuth configuration) can send a crafted id value via POST /api/v0/remove_training_data to inject arbitrary SQL, resulting in mass deletion of all training data or other unauthorized database operations against the BigQuery dataset.

This finding is based on static code audit of Vanna v2.0.2 (latest, commit 365d061).

Details

YLChen-007

Description:

Summary

The /api/v0/generate_plotly_figure endpoint in the Vanna Flask web app accepts a GET request, asks the LLM to generate Python visualization code, then runs it through exec() with no sandboxing. When combined with the existing CSRF surface on generate_sql and run_sql (CVE-2024-6841), an attacker can chain three GET requests to go from "user visits a malicious page" to "arbitrary Python executes on the server."

CVE-2024-6841 stops at "attacker can generate and run SQL." This endpoint extends that chain to arbitrary code execution — a qualitatively different impact that wasn't covered in the original CVE.

Details

The attack involves three endpoints, all registered as GET and all passing through the default NoAuth backend:

YLChen-007

Description:

Summary

The /api/v0/generate_plotly_figure endpoint in the Vanna Flask web app accepts a GET request, asks the LLM to generate Python visualization code, then runs it through exec() with no sandboxing. When combined with the existing CSRF surface on generate_sql and run_sql (CVE-2024-6841), an attacker can chain three GET requests to go from "user visits a malicious page" to "arbitrary Python executes on the server."

CVE-2024-6841 stops at "attacker can generate and run SQL." This endpoint extends that chain to arbitrary code execution — a qualitatively different impact that wasn't covered in the original CVE.

Details

The attack involves three endpoints, all registered as GET and all passing through the default NoAuth backend: