Incident: A chart request that ran attacker code

Module 10 · Incident file · About 30 minutes

What happened

On 31 May 2024 JFrog published CVE-2024-5565 in Vanna, an open-source Python library that turns questions in plain English into SQL. Natan Nehorai of JFrog's security research team found it. The CVE record's title says it plainly: 'Prompt Injection in "ask" API with visualization leads to RCE', where RCE means remote code execution. The score was CVSS 8.1, rated high, and the advisory names no fixed version.

JFrog explained the flaw on 27 June 2024 ("When Prompts Go Rogue: Analyzing a Prompt Injection Code Execution in Vanna.AI"). After running a query, Vanna can draw a chart, and "the Plotly code is not static but is generated dynamically via LLM prompting and code evaluation". The visualize flag is "True (which is the default)". The prompt that asks for chart code contains the user's question and the generated SQL, and the code that comes back is passed to Python's exec. JFrog's verdict: "we can inject any Python code inside the prompt directly into the exec method!"

The sources describe a proof of concept: JFrog's injected line printed the files in the current directory. They do not report an attack on a real deployment. The cost was a high-severity flaw in a default feature. The advisory's mitigation: when the ask API takes outside input, "set the visualize argument to False". JFrog adds that the maintainer published a hardening guide, and that Tong Liu found the same issue independently through the Huntr bug bounty platform, published later as CVE-2024-5826.