CVE-2024-8099

A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as `read_csv`, `read_csv_auto`, `read_text`, and `read_blob`, to make unauthorized requests to internal or external resources. This can lead to unauthorized access to sensitive data, internal systems, and potentially further attacks.

• CWE-918

• https://huntr.com/bounties/19b96694-ed52-4ee4-8d2c-6cc7bd09c0ad

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8092The Accordion Image Menu WordPress plugin through 3.1.3 does…5.4
• CVE-2024-8093The Posts reminder WordPress plugin through 0.20 does not ha…6.5
• CVE-2024-8094The Ntz Antispam WordPress plugin through 2.0e does not have…6.5
• CVE-2024-8095The BabelZ WordPress plugin through 1.1.5 does not have CSR…6.1
• CVE-2024-8096When curl is told to use the Certificate Status Request TLS …6.5
• CVE-2024-8097Exposure of Sensitive Information to an Unauthorized Actor v…6.7
• CVE-2024-8100On affected versions of the Arista CloudVision Portal (CVP o…8.7
• CVE-2024-8101A stored cross-site scripting (XSS) vulnerability exists in …6.1
• CVE-2024-8102The The Ultimate WordPress Toolkit – WP Extended plugin for …8.8
• CVE-2024-8103The WP Category Dropdown plugin for WordPress is vulnerable …5.4
• CVE-2024-8104The The Ultimate WordPress Toolkit – WP Extended plugin for …6.5
• CVE-2024-8105A vulnerability exists in UEFI implementations that use a ha…6.4