PT-2025-10588 · Plotai · Plotai

Eryk Winiarz · Published 2025-03-10 · Updated 2025-10-03 · CVE-2025-1497

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PlotAI (affected versions not specified)

Description A vulnerability has been found that could result in Remote Code Execution (RCE). The issue is due to the lack of validation of LLM-generated output, which allows an attacker to execute arbitrary Python code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

CVE-2025-1497

GHSA-2HMP-5WQG-F24H

PYSEC-2025-22

Affected Products

Plotai

References · 16

• https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde · Patch
• https://osv.dev/vulnerability/CVE-2025-1497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1497 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-22 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hmp-5wqg-f24h · Vendor Advisory
• https://github.com/mljar/plotai · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plotai/PYSEC-2025-22.yaml · Note
• https://t.me/cvetracker/18804 · Telegram Post
• https://twitter.com/CveFindCom/status/1899105848179237306 · Twitter Post
• https://cert.pl/posts/2025/03/CVE-2025-1497 · Note
• https://twitter.com/0dayPublishing/status/1974038996679311474 · Twitter Post
• https://t.me/latest_high_impact_cve/1944 · Telegram Post
• https://reddit.com/r/CyberDudeBivash/comments/1mtntya/daily_cve_roundup_august_18_2025_by · Reddit Post
• https://cert.pl/en/posts/2025/03/CVE-2025-1497 · Note
• https://t.me/cvedetector/19959 · Telegram Post