Skip to content
Fencer Intel
high 8.1

CVE-2024-5565 in the critical feed json

Prompt Injection in "ask" API with visualization leads to RCE

published 2y ago modified 4mo ago also GHSA-7735-w2jp-gvg6 , PYSEC-2026-561 , EUVD-2024-1479

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
15.2%
EPSS 15.2% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitrary Python code instead of the intended visualization code. Specifically - allowing external input to the library’s “ask” method with "visualize" set to True (default behavior) leads to remote code execution.

Is CVE-2024-5565 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

15.18% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi vanna
<=0.5.5
 no fix listed

Affected products

  • vanna-ai vanna

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.