CVE-2024-23752: Code execution in pandasai
GenerateSDFPipeline in syntheticdataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.
Published Jan 22, 2024 · Updated Feb 7, 2024
Affected packages
pandasai
- Ecosystem
- PyPI
- Affected
- <= 1.5.17
- Fixed in
- No patched version yet
- Check
pip show pandasai
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology