189 matches found
msticpy
MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...
CVE-2024-42992
CVE-2024-42992 Python Pip Pandas v2.2.2 has been found to contain an arbitrary file Pip Pandas all versions - =2.2.2 An arbitrary file read vulnerability exists in the "pandas" library, allowing an attacker to read any file in the file system without restrictions. This vulnerability enables...
CVE-2024-3408-dtale
CVE-2024-3408 - D-Tale Authentication Bypass & RCE Reproducible lab environment for CVE-2024-3408, an authentication bypass and remote code execution vulnerability in D-Tale. Vulnerability D-Tale versions up to 3.15.1 are vulnerable due to: 1. Hardcoded SECRETKEY "Dtale" for Flask session signing...
CVE-2026-51898
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
CVE-2026-51898: Undefined Security Weakness
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
EUVD-2026-91705
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
CVE-2026-51898
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
PT-2026-104362
Name of the Vulnerable Software and Affected Versions pandas-ai version 3.0.0 Description The software is subject to code injection within the CodeExecutor.execute function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...
CVE-2026-51898
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
CVE-2026-51898
The sinaptik-ai pandas-ai library, version 3.0.0 , is vulnerable to a Code Injection vulnerability within the CodeExecutor.execute function. This flaw is associated with CWE-94 (Improper Control of Generation of Code). The vulnerability has a CRITICAL severity (CVSS 3.1 score of 9.8 ), allowing f...
sqli-xss-detection
How to run it Open a terminal in the project root: sqlixssdete...
CVE-2026-73487
Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions like pd.readjson to exfiltrate datasets, perform SSRF...
CVE-2026-73487
Flowise prior to version 3.1.3 is affected by a vulnerability in the CSV and Airtable Agent nodes where a regex-based Python code validator bypass enables unauthenticated prompt injection. This can allow an attacker to inject and execute code, exfiltrate datasets via unblocked pandas functions (e...
CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...
CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...
CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods
Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...
CVE-2026-73484
Flowise before 3.1.3 has a sandbox-escape in pythonCodeValidator.ts that allows native Pandas DataFrame methods (to_csv, to_json, pipe, query) to bypass restrictions. This enables authenticated attackers to exfiltrate uploaded CSV data or write arbitrary files to the server filesystem. Reported i...
Flowise: Remote Code Execution Vulnerability in CSVAgent
Summary The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to utilise the pandas library for CSV processing. Although there is a denylist that checks for dangerous Python constructs from being passed in, panda...
python313-pandas-3.0.3-1.2 on GA media (moderate)
python313-pandas-3.0.3-1.2 on GA media Announcement ID: openSUSE-SU-2026:11341-1 Rating: moderate Cross-References: CVE-2023-47248 CVSS scores: CVE-2023-47248 SUSE : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can...