CVE-2026-5321
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Apr 2, 2026
CISA due date
—
The record
A flaw has been found in vanna-ai vanna up to 2.0.2. Affected by this issue is some unknown functionality of the component FastAPI/Flask Server. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-346
- CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-346
- CVE-2026-94485 Next.js is a React framework for building full-stack web applications. CWE-346
- CVE-2026-94486 Next.js is a React framework for building full-stack web applications. CWE-346
- CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity… CWE-346
- CVE-2026-87563 Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-346
- CVE-2026-85152 undici 8.10.0 omits the destination origin from the cache and request-deduplication keys… CWE-346
- CVE-2026-84482 WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability… CWE-346