SQL Injection Stacked Statement in LLM-Generated Query Execution
When an AI agent turns a natural-language request into a SQL query and hands it to a command-line database client, an attacker can slip in a semicolon followed by their own command. Vulnerable versions of the Vanna AI toolkit (CVE-2024-7764, <=0.6.2) fail to strip this out, so the attacker's command runs instead of the intended query.
How the attack works
An attacker crafts input that causes the AI's SQL-generation step to produce a string containing a semicolon followed by a destructive or file/OS-touching SQL statement. Vanna's extract_sql() function discards the legitimate SELECT and keeps the attacker's appended statement, and is_sql_valid() lets it through. That string is then passed to a command-line database client (psql, mysql, sqlite3, duckdb) that the agent shells out to, and the attacker's statement executes against the database.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c1d2e-9b4a-4a61-8f0d-2c5e7a9b6d31
- Severity
- Medium
- CVEs
- CVE-2024-7764
Why it matters
An attacker can run arbitrary database commands -- altering data, dropping tables, or reaching the file system/OS through database functions -- by hiding them inside what looks like a normal AI-generated query.
What you can do
- →Upgrade Vanna past 0.6.2 or stop passing LLM-generated SQL directly to a shell-invoked database client.
- →Reject or strip any generated SQL string containing a semicolon followed by additional statements before execution.
- →Run agent-generated queries through a parameterized query interface or a restricted, read-only database role instead of a full CLI client.
- →Wrap any legitimate multi-statement operations (migrations, ETL) explicitly in BEGIN...COMMIT so they can be told apart from injected stacked statements.
Known benign look-alikes
- Database migrations run as one-liners, e.g. psql -c "ALTER TABLE x ...; UPDATE y ..." -- suppressed only when explicitly wrapped in BEGIN; ... COMMIT;, so unwrapped migration one-liners will still report.
- Test-suite setup and teardown that drops or recreates scratch objects; suppressed when the object name starts with tmp/temp/test/staging/scratch/underscore, but non-conforming naming conventions will report.
- ETL and bulk-load jobs using COPY / LOAD DATA after a preparatory statement in the same inline string.
- Analytics work in duckdb or sqlite3 where an operator legitimately stacks CREATE TABLE AS ... ; SELECT ... in a single -c argument.
- dbt, Flyway, Liquibase or Alembic wrappers that shell out to a CLI client with multi-statement SQL.
- Authorised database penetration testing or a red-team exercise executed through the agent.