Security: SQL injection in Databricks/BigQuery vector stores + unsafe exec() on LLM output

Security Concerns

Two security issues found during code audit:

1. SQL Injection in BigQuery Vector Store

File: src/vanna/bigquery/bigquery_vector.py - remove_training_data()

# Vulnerable pattern:
delete_sql = f"DELETE FROM ... WHERE id = '{id}'"

The id parameter is interpolated directly into SQL via f-string. An attacker can inject SQL like '; DELETE FROM table; --.

Fix: Use parameterized queries:

query_params = [bigquery.ScalarQueryParameter("id", "STRING", id)]

2. Unsafe exec() on LLM-Generated Visualization Code

File: src/vanna/base/base.py - Plotly code generation

LLM-generated Python code for Plotly visualizations is executed via exec() without sandboxing. If an attacker can influence the LLM output (via data poisoning or adversarial prompts in the database), the generated code could contain malicious payloads.

Fix: Use a restricted execution environment or validate generated code before execution.

Note

I attempted to use GitHub's private vulnerability reporting but it appears to be disabled for this repository. I'd recommend enabling it at Settings → Code security → Private vulnerability reporting.

Discovered during security audit by Lighthouse Research Project (https://lighthouse1212.com)