GHSA-8fp9-43pw-56vw

Source

https://github.com/advisories/GHSA-8fp9-43pw-56vw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-8fp9-43pw-56vw/GHSA-8fp9-43pw-56vw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8fp9-43pw-56vw

Aliases

CVE-2023-39661

Published

2023-08-15T18:31:32Z

Modified

2024-02-16T08:19:54.715244Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

PandasAI vulnerable to arbitrary code execution

Details

An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.

Database specific

{
    "nvd_published_at": "2023-08-15T17:15:13Z",
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-15T21:10:21Z"
}

References

Affected packages

PyPI / pandasai

Package

Name: pandasai; View open source insights on deps.dev
Purl: pkg:pypi/pandasai

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.8.1

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.1.0

0.1.1

0.2.0

0.2.1

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.2.8

0.2.9

0.2.10

0.2.11

0.2.12

0.2.13

0.2.14

0.2.15

0.2.16

0.3.0

0.4.0

0.4.1

0.4.2

0.5.0

0.5.1

0.5.2

0.5.3

0.5.4

0.5.5

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.6

0.6.7

0.6.8

0.6.9

0.6.10

0.6.11

0.6.12

0.7.0

0.7.1

0.7.2

0.8.0

0.8.1