GitHub Advisoryadvisory · PyPI

GHSA-5g73-69p4-7gvx Code execution in pandasai

CRITICAL Published 2024-01-22 Modified 2024-01-29 Official page ↗
Aliases
CVE-2024-23752
Ecosystem
PyPI
Packages
pandasai
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862, CWE-94
Reviewed
2024-01-22

Affected packages

• PyPI pandasai: <= 1.5.17 (no fix yet)

Description

GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.

Related

Alias · CVE (1)

  • CVE-2024-23752 GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-94 Improper Control of Generation of Code weakness

References