Dify Tools Vanna Module Pandas Query Injection Vulnerability Allowing Remote Code Execution

A Pandas query injection vulnerability has been identified in the Vanna module of the langgenius/dify repository, specifically in the latest version. The issue arises in the function 'vn.get_training_plan_generic(df_information_schema)', where user inputs are not adequately sanitized before being used in queries with the Pandas library. This lack of proper input validation could potentially be exploited to achieve remote code execution.

Impact

Exploitation of this vulnerability could lead to remote code execution on the server where the application is running.