CVE-2024-7764 Overview
CVE-2024-7764 is a SQL injection vulnerability in Vanna-AI version 0.6.2, an open-source Python library that translates natural language questions into SQL queries using large language models (LLMs). The flaw resides in the generate_sql function, which passes an LLM response to extract_sql without adequately sanitizing user-controlled content. An authenticated attacker can inject a semicolon followed by an arbitrary SQL statement into a search field. The extract_sql function then strips the LLM-generated SQL and forwards the attacker's statement to is_sql_valid, which executes it against the backing database. This bypasses the trained schema boundaries expected by the application.
Critical Impact
Authenticated attackers can execute arbitrary SQL against the backing database, exposing or modifying data outside of the trained schema boundaries.
Affected Products
- Vanna-AI v0.6.2
- Python-based text-to-SQL applications built on Vanna-AI
- Downstream services embedding the vulnerable generate_sql and extract_sql code paths
Discovery Timeline
- 2025-03-20 - CVE-2024-7764 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7764
Vulnerability Analysis
Vanna-AI converts natural language prompts into SQL statements using an LLM trained on a target database schema. When a user submits a request, generate_sql sends the prompt to the LLM and passes the response into extract_sql. The extractor is designed to isolate the SQL statement produced by the model. However, it treats a semicolon in the user-supplied data as a statement delimiter. An attacker can embed ; followed by a crafted statement inside a search field. The extractor discards the LLM-generated query preceding the semicolon and returns the attacker's statement. is_sql_valid performs syntactic validation only, so the injected statement passes and is executed. This is a classic SQL injection weakness classified as [CWE-89].
Root Cause
The root cause is improper neutralization of special characters in the text passed to the LLM and returned by it. Neither extract_sql nor is_sql_valid distinguishes between the model's intended query and injected user input. The extractor relies on delimiter parsing rather than parameterized query construction. The validity check confirms grammar but not authorization scope against the trained schema.
Attack Vector
Exploitation requires network access and low-privilege authentication to an application exposing Vanna-AI's generate_sql endpoint. The attacker enters a value such as a product name followed by ; DROP TABLE users -- into a search-style field. The LLM includes the tainted text in its output. The extractor then returns the attacker's statement, which the backend executes with the database privileges granted to the Vanna-AI process. See the Huntr Bounty Submission for reproduction details.
Detection Methods for CVE-2024-7764
Indicators of Compromise
- Database query logs containing multiple statements separated by semicolons originating from the Vanna-AI service account
- SQL statements referencing tables, schemas, or objects outside the schema Vanna-AI was trained on
- Unexpected DROP, ALTER, INSERT, or UPDATE operations attributed to the Vanna-AI application user
Detection Strategies
- Enable database query auditing and alert on statements from the application account that touch tables outside the approved schema allow-list
- Parse application logs for user inputs containing ;, --, or common SQL keywords submitted to natural-language search endpoints
- Correlate LLM prompt logs with executed SQL to detect divergence between generated queries and executed statements
Monitoring Recommendations
- Forward application, LLM, and database logs to a centralized analytics platform and baseline normal query patterns
- Monitor for spikes in query error rates or schema errors, which often accompany injection probing
- Track authentication events for the Vanna-AI service and flag unusual source IPs or session volumes
How to Mitigate CVE-2024-7764
Immediate Actions Required
- Upgrade Vanna-AI to a version later than 0.6.2 that addresses the extract_sql handling, per the maintainer's advisory
- Restrict the database account used by Vanna-AI to read-only access on the trained schema and revoke DDL privileges
- Add server-side input validation to reject characters such as ; and SQL comment markers in user-supplied search fields
Patch Information
Refer to the Huntr Bounty Submission for the disclosure record and links to remediation guidance from the Vanna-AI maintainers. Upgrade to the patched release and redeploy dependent services.
Workarounds
- Place Vanna-AI behind an application-layer filter that rejects requests containing SQL metacharacters in free-text fields
- Enforce an allow-list of schema objects at the database proxy layer so only approved tables and columns are queryable
- Disable multi-statement execution on the database driver used by Vanna-AI to prevent chained queries via a single call
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
