developergpt (>=0.4.0, <=0.7.5), genericsuite-ai (>=0.1.10, <=0.1.14) +2 more potentially affected by CVE-2026-0599 via text-generation (0.6.1)

text-generation PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on text-generation and may be impacted: - developergpt =0.4.0, =0.1.10, =3.0.0, =0.1.2, =0.1.5 Source cves: CVE-2026-0599 Source advisory: OSV:PYSEC-2026-1965...

PYSEC-2026-1757 pandasai vulnerable to prompt injection

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function...

pandasai vulnerable to prompt injection

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function...

Python PandasAI SQL Injection File Read

The vulnerability of the Python PandasAI library is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability can allow an attacker operating remotely to gain read access to arbitrary files...

PandasAI vulnerable to arbitrary code execution

An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary code via the isjailbreak function...

PYSEC-2026-447 PandasAI vulnerable to arbitrary code execution

An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary code via the isjailbreak function...

Code execution in pandasai

GenerateSDFPipeline in syntheticdataframe in PandasAI aka pandas-ai through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE:...

exposeq (>=4.1.3, <=4.6.1), squadds (>=0.0.0, <=0.0.3) potentially affected by CVE-2024-23752 via pandasai (>=1.3.3, <=1.5.11)

pandasai PYPI version =1.3.3, =4.1.3, =0.0.0, =0.0.3 Source cves: CVE-2024-23752 Source advisory: OSV:PYSEC-2026-446...

exposeq (>=4.1.3, <=4.6.1) potentially affected by CVE-2024-12366 via pandasai (1.3.3)

pandasai PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pandasai and may be impacted: - exposeq =4.1.3, =4.6.1 Source cves: CVE-2024-12366 Source advisory: OSV:PYSEC-2026-448...

PandasAI interactive prompt function Remote Code Execution (RCE)

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution RCE instead of the intended explanation of the natural language processing by the LLM. The security controls of PandasAI 2.4.3 and earlier fail ...

squadds (>=0.0.0, <=0.0.3) potentially affected by CVE-2024-12366 via pandasai (1.5.11)

pandasai PYPI version 1.5.11 is affected by a known vulnerability. The following packages have a transitive dependency on pandasai and may be impacted: - squadds =0.0.0, =0.0.3 Source cves: CVE-2024-12366 Source advisory: OSV:PYSEC-2026-448...

date-a-scientist (>=0.1.0, <=0.1.19), exposeq (>=4.0.7, <=4.1.2) +3 more potentially affected by CVE-2024-12366 via pandasai (>=2.3.0, <=2.4.2)

pandasai PYPI version =2.3.0, =0.1.0, =4.0.7, =0.0.9, =0.0.13 - pandasai-enterprise 0.1.0 Source cves: CVE-2024-12366 Source advisory: OSV:PYSEC-2026-448...

PYSEC-2026-448 PandasAI interactive prompt function Remote Code Execution (RCE)

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution RCE instead of the intended explanation of the natural language processing by the LLM. The security controls of PandasAI 2.4.3 and earlier fail ...

PT-2026-53529

PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution RCE instead of the intended explanation of the natural language processing by the LLM. The security controls of PandasAI 2.4.3 and earlier fail ...

EUVD-2026-17959

pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base.executesqlquery component...

PandasAI security vulnerabilities

PandasAI is an open-source Python library developed by PandasAI. It integrates artificial intelligence functions into pandas. Version 3.0.0 of PandasAI contains a security vulnerability, which stems from an SQL injection vulnerability in the pandasai.agent.base.executesqlquery component...

CVE-2026-4998

A weakness has been identified in Sinaptik AI PandasAI up to 3.0.0. This vulnerability affects the function CodeExecutor.execute of the file pandasai/core/codeexecution/codeexecutor.py of the component Chat Message Handler. Executing a manipulation can lead to code injection. The attack may be...

CVE-2026-4997

A security flaw has been discovered in Sinaptik AI PandasAI up to 3.0.0. This affects the function issqlquerysafe of the file pandasai/helpers/sqlsanitizer.py. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been released to the public an...

CVE-2026-4996

A vulnerability was identified in Sinaptik AI PandasAI up to 0.1.4. Affected by this issue is the function deletequestionandanswers/deletedocs/updatequestionanswer/updatedocs/getrelevantquestionanswersbyid/getrelevantdocsbyid of the file extensions/ee/vectorstores/lancedb/pandasailancedb/lancedb....

EUVD-2026-16925

A weakness has been identified in Sinaptik AI PandasAI up to 3.0.0. This vulnerability affects the function CodeExecutor.execute of the file pandasai/core/codeexecution/codeexecutor.py of the component Chat Message Handler. Executing a manipulation can lead to code injection. The attack may be...