PT-2026-28715 · Sinaptik Ai · Pandasai

Eric-B + 1 · Published 2026-03-28 · Updated 2026-03-29 · CVE-2026-4997

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sinaptik AI PandasAI versions up to 3.0.0

Description A security flaw exists in Sinaptik AI PandasAI up to version 3.0.0. The issue resides within the is sql query safe function located in the pandasai/helpers/sql sanitizer.py file, allowing for path traversal. This issue can be exploited remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 3.0.0 should be used. As a temporary workaround, consider restricting access to the pandasai/helpers/sql sanitizer.py file to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4997

Affected Products

Pandasai

References · 6

• 🔥 https://gist.github.com/YLChen-007/0ea2685789929bdb6363f5aebb7cba9a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4997 · Security Note
• https://vuldb.com/submit/778269 · Note
• https://vuldb.com/vuln/353884/cti · Note
• https://twitter.com/CVEarity/status/2038191202391220263 · Twitter Post
• https://vuldb.com/vuln/353884 · Note