CVE-2024-12366

CVE-2024-12366 PUBLISHED

Description (CNA)

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM.

Affected (CNA)

Vendor / product	Versions
Sinaptik AI / PandasAI	affected 2.4.0

CWE

No CWE identifiers supplied.

References

https://docs.pandas-ai.com/advanced-security-agent
https://docs.getpanda.ai/v3/privacy-security

ADP enrichment

CVE

No English description supplied.

https://www.kb.cert.org/vuls/id/148244

CISA-ADP

No English description supplied.

No references supplied.