PT-2023-27060 · Pandasai · Pandasai

Lyutoo · Published 2023-08-15 · Updated 2023-08-22 · CVE-2023-39661

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pandas-ai versions 0.9.1 and earlier pandas-ai versions 0.8.1 and earlier

Description An issue in pandas-ai allows a remote attacker to execute arbitrary code via the is jailbreak function. This enables the attacker to perform malicious actions on the affected system.

Recommendations For versions 0.9.1 and earlier, update to a version later than 0.9.1 to resolve the issue. For versions 0.8.1 and earlier, update to a version later than 0.8.1 to resolve the issue. As a temporary workaround, consider disabling the is jailbreak function until a patch is available.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2023-39661

GHSA-8FP9-43PW-56VW

Affected Products

Pandasai

References · 8

• 🔥 https://github.com/gventuri/pandas-ai/issues/410 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39661 · Security Note
• https://osv.dev/vulnerability/GHSA-8fp9-43pw-56vw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39661 · Vendor Advisory
• https://github.com/gventuri/pandas-ai · Note
• https://twitter.com/CVEnew/status/1691493241533739015 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691522981640507393 · Twitter Post
• https://t.me/cibsecurity/68558 · Telegram Post