AI agent vulnerability · PandasAI
CVE-2023-39660: pandasai vulnerable to prompt injection
highGHSA-w832-v3c6-m6rg
An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.
Published Aug 21, 2023 · Updated Nov 6, 2023
Affected packages
pandasai
- Ecosystem
- PyPI
- Affected
- < 0.8.1
- Fixed in
- 0.8.1
- Check
pip show pandasai
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology