PT-2026-28715 · Sinaptik Ai · Pandasai

Eric-B + 1 · Publicado 2026-03-28 · Atualizado 2026-03-29 · CVE-2026-4997

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sinaptik AI PandasAI versions up to 3.0.0

Description A security flaw exists in Sinaptik AI PandasAI up to version 3.0.0. The issue resides within the is sql query safe function located in the pandasai/helpers/sql sanitizer.py file, allowing for path traversal. This issue can be exploited remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 3.0.0 should be used. As a temporary workaround, consider restricting access to the pandasai/helpers/sql sanitizer.py file to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-4997

Produtos afetados

Pandasai

Referências · 6

• 🔥 https://gist.github.com/YLChen-007/0ea2685789929bdb6363f5aebb7cba9a · Exploit
• https://vuldb.com/submit/778269 · Nota
• https://vuldb.com/vuln/353884/cti · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4997 · Nota de Segurança
• https://twitter.com/CVEarity/status/2038191202391220263 · Publicação no Twitter
• https://vuldb.com/vuln/353884 · Nota