Lucene search

Veracode Vulnerability DatabaseVERACODE:45129

HistoryJan 23, 2024 - 9:34 a.m.

Code Injection

2024-01-2309:34:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

pandasai

code injection

vulnerability

prompt sanitization

generatesdfpipeline

sdfcodeexecutor

python code

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

50.3%

JSON

pandasai is vulnerable to Code Injection. The vulnerability due improper prompt sanitization within the synthetic_dataframe function located in the GenerateSDFPipeline component. It allows an attacker to execute arbitrary Python code by the SDFCodeExecutor.

References

github.com/advisories/GHSA-5g73-69p4-7gvx

github.com/gventuri/pandas-ai/blob/36f3f239da68186d71163e977475e418f9bb82ff/pandasai/pipelines/synthetic_dataframe/generate_sdf_pipeline.py

github.com/gventuri/pandas-ai/issues/868

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

50.3%

JSON

Related for VERACODE:45129