CVE-2024-23752 - GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor

Back Back to CVE browser

CRITICAL

GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor

Published Jan 22, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 1.01%

Description

GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-862

Missing Authorization

CWE-94

Code Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0261
Advisory
https://github.com/advisories/GHSA-5g73-69p4-7gvx
Advisory
https://github.com/gventuri/pandas-ai/issues/868
ExploitMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-23752

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0261		Advisory
https://github.com/advisories/GHSA-5g73-69p4-7gvx		Advisory
https://github.com/gventuri/pandas-ai/issues/868		ExploitMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-23752