Loading...
Skip to main content
GeekWala

CVE-2024-12366 — Vulnerability in pandasai — CVE Details

CRITICAL

PandasAI interactive prompt function Remote Code Execution (RCE)

Published February 11, 2025Updated September 10, 2026Source: osv

Summary

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM. The security controls of PandasAI (2.4.3 and earlier) fail to distinguish between legitimate and malicious inputs, allowing the attackers to manipulate the system into executing untrusted code, leading to untrusted code execution (RCE), system compromise, or pivoting attacks on connected services.

Advisory Timeline

  • First published February 11, 2025 (608 days ago).
  • Last revised September 10, 2026 — 576 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: pypi (1).

PackageEcosystemAffectedFixed In
pandasai
pypi
0.0.1, 0.0.2, 0.0.3, 0.1.0 (+190 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-12366?
PandasAI interactive prompt function Remote Code Execution (RCE) This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-12366?
CVE-2024-12366 affects pandasai. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-12366 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-vv2h-2w3q-3fx7
PYSEC-2026-448

Related CVEs

More PyPI advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies