A vulnerability was found in vanna-ai vanna up to 2.0.2 and classified as critical. Affected by this issue is some unknown functionality of the component FastAPI/Flask Server. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains.
This vulnerability is tracked as CVE-2026-5321. The attack can be launched remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
