What’s Vulnerable › Vulnerabilities
CVE-2024-23752
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-01-22 · updated 2026-06-17
- Weakness: CWE-862
Description
GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.
Affected products
- Gabrieleventuri Pandasai: through 1.5.17
References
Get alerted when CVE-2024-23752 or the next vulnerability affects your stack