Vulnerability Description
GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gabrieleventuri | Pandasai | <= 1.5.17 |
Related Weaknesses (CWE)
References
- https://github.com/gventuri/pandas-ai/issues/868ExploitMailing ListVendor Advisory
- https://github.com/gventuri/pandas-ai/issues/868ExploitMailing ListVendor Advisory
FAQ
What is CVE-2024-23752?
CVE-2024-23752 is a vulnerability with a CVSS score of 9.8 (CRITICAL). GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attack...
How severe is CVE-2024-23752?
CVE-2024-23752 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-23752?
Check the references section above for vendor advisories and patch information. Affected products include: Gabrieleventuri Pandasai.