CVE-2026-4511

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads to injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-707

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-451127.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0CVE-2026-451158.7MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attCVE-2026-451168.7MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profiCVE-2026-451179.8MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database CVE-2026-451189.3MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resCVE-2026-451194.6MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correcCVE-2026-45123.5The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScriCVE-2026-451205.4MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowinCVE-2026-451214.3MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calenCVE-2026-451224.3MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destinatiCVE-2026-451234.3MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resultinCVE-2026-451244.3MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing mod
CVE-2026-4511: Medium severity, CVSS 6.3 | Vulnix