CVE-2024-7764
CVSS 3.0 Score 8.1 of 10 (high)
Details
Published Mar 20, 2025
CWE ID 89
Summary
CVE-2024-7764 is a new SQL Injection vulnerability affecting Vanna-ai version 0.6.2. The issue arises due to the insufficient validation of user input in the `generate_sql` function, which enables an attacker to inject malicious SQL commands. By inserting a semicolon between a search data field and their command, an attacker can bypass the legitimate SQL query and execute their own commands, extending beyond the expected schema. This potentially dangerous vulnerability may lead to unauthorized data access or manipulation.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.