CVE-2024-7764

CVE-2024-7764 is a high-severity SQL Injection vulnerability affecting Vanna-ai v0.6.2. An authenticated attacker can bypass intended SQL generation by injecting malicious commands via user requests, specifically by appending a semicolon and their own SQL to a search data field. This allows for the execution of arbitrary SQL queries beyond the trained schema, leading to potential compromise of data confidentiality and integrity. The vulnerability has a CVSS score of 8.1 (HIGH), indicating a network-based attack with low attack complexity and no user interaction required, resulting in high impact on confidentiality and integrity. While the EPSS score is low, suggesting a low probability of exploitation, its FAUCET Risk Score is 76/100, highlighting its potential danger. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion or media coverage has been observed for this CVE.