SQL Injection vulnerability in `remove_training_data` (CVE-2026-4229)

[AdityaSarwade]

Describe the bug
The function remove_training_data in src/vanna/legacy/google/bigquery_vector.py appears vulnerable to SQL Injection due to unsanitized handling of the id arguement.
According to CVE-2026-4229, externally controlled input passed to this function can be manipulated to modify the generated SQL query, allowing remote attackers to execute unintended SQL commands. The issue affects versions <= 2.0.2 and currently does not appear to have a patched release.
This represents a security risk for applications exposing training-data deletion functionality through user control inputs

To Reproduce
Steps to reproduce the behavior:

1. Install vanna <= 2.0.2
2. Use the BigQuery vector store backend
3. Call remove_training_data(id=...) with a crafted payload
4. Observe that the constructed a scale query is directly influenced by the input value without parameterization.
   This allows injection into the generated query.

Example(illustrative):
vn.remove_training_date(id="1 OR 1=1")

Expected behavior

The remove_training_data function should use parameterized queries (or proper escaping) show that user supplied ID values cannot modify the structure of the generated SQL query.

Reference advisory
<cve.org/CVERecord?id=CVE-2026-4229>
<gist.github.com/YLChen-007/b4f326eaecc29b192cf93dc5d6bc0623>

Desktop (please complete the following information where):

• Python: [3.12.8]
• Vanna: [2.0.2]

[ZhangDT-sky]

I've opened a PR to fix this issue: #1122
I updated both BigQuery_VectorStore and PG_VectorStore to use parameterized queries and added unit tests.

[Mamidi7]

I've submitted PR #1128 which fixes the SQL injection vulnerability using parameterized queries as described.

Fix Summary

• Changed f-string interpolation to BigQuery parameterized query with ScalarQueryParameter
• User input id is now passed as a bound parameter, not interpolated into SQL
• No behavioral change for legitimate callers

PR: #1128