CVE-2024-12366

critical · 9.8

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM.

9.8

CVSS

1.2%

EPSS (exploit prob.)

67th

EPSS percentile

2025-02-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://docs.getpanda.ai/v3/privacy-security
https://docs.pandas-ai.com/advanced-security-agent
https://www.kb.cert.org/vuls/id/148244

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-12366