Vulnerability Description
A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mljar | Plotai | < 0.0.7 |
Related Weaknesses (CWE)
References
- https://cert.pl/en/posts/2025/03/CVE-2025-1497Third Party Advisory
- https://cert.pl/posts/2025/03/CVE-2025-1497Third Party Advisory
- https://github.com/mljar/plotaiProduct
- https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fdePatch
FAQ
What is CVE-2025-1497?
CVE-2025-1497 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor comment...
How severe is CVE-2025-1497?
CVE-2025-1497 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-1497?
Check the references section above for vendor advisories and patch information. Affected products include: Mljar Plotai.