CVE-2026-51911 Overview
CVE-2026-51911 is a code injection vulnerability in vanna v2.0.2, an open-source Python library that generates SQL from natural language using large language models. The flaw resides in the VannaBase.get_plotly_figure function located in src/vanna/legacy/base/base.py. Depending on how the vulnerable entry point is exposed, an attacker can trigger execution of attacker-controlled code or operating system commands. The weakness is categorized under CWE-94: Improper Control of Generation of Code.
Critical Impact
Unauthenticated network attackers can achieve arbitrary code execution on hosts running vanna v2.0.2, leading to full compromise of application confidentiality, integrity, and availability.
Affected Products
- vanna v2.0.2 (src/vanna/legacy/base/base.py)
- Applications embedding the VannaBase.get_plotly_figure method
- Downstream services exposing vanna chart generation over a network interface
Discovery Timeline
- 2026-10-02 - CVE-2026-51911 published to NVD
- 2026-10-05 - Last updated in NVD database
Technical Details for CVE-2026-51911
Vulnerability Analysis
The vulnerability affects VannaBase.get_plotly_figure, a helper that converts model-generated Python into a Plotly visualization. The function passes untrusted, model- or user-supplied Python source into a dynamic execution context without sandboxing or validation. When a vanna-based application exposes a chat, API, or notebook interface that reaches get_plotly_figure, remote attackers can submit prompts or payloads that cause arbitrary Python execution. From Python, attackers can invoke os.system, subprocess, or in-process library calls to run commands, exfiltrate credentials, or pivot inside the environment.
Root Cause
The root cause is improper control of code generation ([CWE-94]). The affected method evaluates generated plotting code as live Python instead of parsing or rendering it in a restricted interpreter. Because large language model output is not trustworthy input, any attacker who can influence the generated chart code can insert arbitrary statements that execute with the privileges of the vanna process.
Attack Vector
Exploitation requires network access to any application that exposes the vulnerable chart generation path. No authentication or user interaction is required when the entry point is public. An attacker crafts a prompt or request that steers the model, or directly supplies code, so that the resulting Python passed to get_plotly_figure contains hostile statements. Execution then occurs server-side when the chart is rendered. Technical references are available in the GitHub Gist proof-of-concept script and the vanna-ai GitHub repository.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-51911
Indicators of Compromise
- Unexpected child processes spawned by the Python interpreter hosting vanna, especially shells, curl, wget, or package managers.
- Outbound network connections from the vanna process to unfamiliar hosts shortly after chart generation requests.
- Writes to sensitive paths such as /etc, ~/.ssh, or application secret stores by the vanna service account.
- Prompt or request payloads containing Python builtins such as __import__, eval, exec, os.system, or subprocess.
Detection Strategies
- Instrument the application to log all code strings passed to get_plotly_figure and alert on dangerous tokens.
- Monitor process ancestry so that any non-Plotly process spawned from the vanna worker triggers an investigation.
- Correlate web request traces with host-level process creation events to tie prompts to downstream commands.
Monitoring Recommendations
- Enable EDR process-tree telemetry on all hosts running vanna and ship events to a centralized data lake.
- Baseline outbound connections from the vanna service and alert on first-seen destinations.
- Review authentication logs for any service account used by vanna to detect lateral movement following exploitation.
How to Mitigate CVE-2026-51911
Immediate Actions Required
- Inventory all deployments using the vanna Python package and identify any at version 2.0.2 or any version exposing VannaBase.get_plotly_figure.
- Restrict network access to vanna-powered endpoints so that only authenticated internal users can submit prompts.
- Run the vanna process under a dedicated low-privilege account with no access to secrets, credentials, or production data stores.
- Disable or stub the chart generation path until a fixed release is deployed.
Patch Information
At the time of publication, no fixed version has been referenced in the NVD entry. Monitor the vanna-ai GitHub repository for security releases and upgrade guidance. Pin the dependency to a known-safe version once published and rebuild downstream container images.
Workarounds
- Replace calls to get_plotly_figure with a safe rendering path that parses model output as JSON or a restricted DSL instead of executing Python.
- Wrap the vanna process in a container or seccomp profile that blocks execve, outbound network calls, and filesystem writes outside a scratch directory.
- Validate and reject any generated code string containing imports, attribute access to os, sys, subprocess, or dunder methods before execution.
# Configuration example: pin vanna away from the vulnerable release
pip uninstall -y vanna
pip install 'vanna!=2.0.2'
# Run the service under an isolated account with no shell
useradd --system --no-create-home --shell /usr/sbin/nologin vanna-svc
sudo -u vanna-svc python -m vanna.server
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
