Vanna 2.0.2 contains a code injection flaw in the VannaBase.get_plotly_figure method. The vulnerability allows an attacker to insert arbitrary code or system commands through the exposed entry parameter, enabling execution of code on the host running the Vanna service.

Any deployment of vanna 2.0.2 that exposes the get_plotly_figure functionality to external input is vulnerable. No vendor or product cpes are listed, but the flaw exists in the Python package and would affect any web or API service that incorporates it.

The flaw carries a high potential impact, as it can lead to full code execution. The CVSS score of 9.8 indicates critical severity. The EPSS score is < 1%, suggesting low likelihood of exploitation. The vulnerability is not listed in CISA KEV catalog, so no documented exploitation activity is available. The likely attack vector is remote, via crafted input to an exposed API or user interface, and exploitation requires the attacker to control the entry parameter.