Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Vanna 2.0.2 lets attackers run their own code

CVE-2026-51911 · published 16 days ago
Summary

The Vanna software version 2.0.2 contains a weakness that could let a malicious user cause the program to execute code they supply. This could lead to unauthorized actions on your system or data being compromised. Upgrade to a newer version of Vanna or apply the vendor's security patch as soon as possible.

Original advisory text
vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code...
vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-51911 · NVD
CVE-2026-51911 · MITRE
Track software like this
Free during beta