by Kastro
Paper/Archive/CVE-2024-12366

CVE-2024-12366

Sinaptik AI PandasAI — CVE-2024-12366

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.5.685 × 2013.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM.

Affected

ProductAffectedFixed inSource
PandasAI2.4.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdocs.pandas-ai.com/advanced-security-agentrefdocs.getpanda.ai/v3/privacy-securityrefkb.cert.org/vuls/id/148244