PT-2023-27060 · Pandasai · Pandasai

Lyutoo · Publicado 2023-08-15 · Atualizado 2023-08-22 · CVE-2023-39661

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pandas-ai versions 0.9.1 and earlier pandas-ai versions 0.8.1 and earlier

Description An issue in pandas-ai allows a remote attacker to execute arbitrary code via the is jailbreak function. This enables the attacker to perform malicious actions on the affected system.

Recommendations For versions 0.9.1 and earlier, update to a version later than 0.9.1 to resolve the issue. For versions 0.8.1 and earlier, update to a version later than 0.8.1 to resolve the issue. As a temporary workaround, consider disabling the is jailbreak function until a patch is available.

Exploit

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

CVE-2023-39661

GHSA-8FP9-43PW-56VW

Produtos afetados

Pandasai

Referências · 8

• 🔥 https://github.com/gventuri/pandas-ai/issues/410 · Exploit
• https://github.com/gventuri/pandas-ai · Nota
• https://twitter.com/CVEnew/status/1691493241533739015 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-39661 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1691522981640507393 · Publicação no Twitter
• https://t.me/cibsecurity/68558 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-8fp9-43pw-56vw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-39661 · Aviso do Fabricante