Vulnerabilities > CVE-2024-23752 - Missing Authorization vulnerability in Gabrieleventuri Pandasai

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

gabrieleventuri

CWE-862

critical

NVD

Published: 2024-01-22

Updated: 2024-01-29

Summary

GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.

Vulnerable Configurations

Part	Description	Count
Application	Gabrieleventuri Gabrieleventuri Pandasai 0.0.1 Gabrieleventuri Pandasai 0.0.2 Gabrieleventuri Pandasai 0.0.3 Gabrieleventuri Pandasai 0.1.0 Gabrieleventuri Pandasai 0.1.1 Gabrieleventuri Pandasai 0.2.0 Gabrieleventuri Pandasai 0.2.1 Gabrieleventuri Pandasai 0.2.2 Gabrieleventuri Pandasai 0.2.3 Gabrieleventuri Pandasai 0.2.4 Gabrieleventuri Pandasai 0.2.5 Gabrieleventuri Pandasai 0.2.6 Gabrieleventuri Pandasai 0.2.7 Gabrieleventuri Pandasai 0.2.8 Gabrieleventuri Pandasai 0.2.9 Gabrieleventuri Pandasai 0.2.10 Gabrieleventuri Pandasai 0.2.11 Gabrieleventuri Pandasai 0.2.12 Gabrieleventuri Pandasai 0.2.13 Gabrieleventuri Pandasai 0.2.14 Gabrieleventuri Pandasai 0.2.15 Gabrieleventuri Pandasai 0.2.16 Gabrieleventuri Pandasai 0.3.0 Gabrieleventuri Pandasai 0.3.1 Gabrieleventuri Pandasai 0.4.0 Gabrieleventuri Pandasai 0.4.1 Gabrieleventuri Pandasai 0.4.2 Gabrieleventuri Pandasai 0.5.0 Gabrieleventuri Pandasai 0.5.1 Gabrieleventuri Pandasai 0.5.2 Gabrieleventuri Pandasai 0.5.3 Gabrieleventuri Pandasai 0.5.4 Gabrieleventuri Pandasai 0.5.5 Gabrieleventuri Pandasai 0.6.0 Gabrieleventuri Pandasai 0.6.1 Gabrieleventuri Pandasai 0.6.2 Gabrieleventuri Pandasai 0.6.3 Gabrieleventuri Pandasai 0.6.4 Gabrieleventuri Pandasai 0.6.5 Gabrieleventuri Pandasai 0.6.6 Gabrieleventuri Pandasai 0.6.7 Gabrieleventuri Pandasai 0.6.8 Gabrieleventuri Pandasai 0.6.9 Gabrieleventuri Pandasai 0.6.10 Gabrieleventuri Pandasai 0.6.11 Gabrieleventuri Pandasai 0.6.12 Gabrieleventuri Pandasai 0.7.0 Gabrieleventuri Pandasai 0.7.1 Gabrieleventuri Pandasai 0.7.2 Gabrieleventuri Pandasai 0.8.0 Gabrieleventuri Pandasai 0.8.1 Gabrieleventuri Pandasai 0.8.2 Gabrieleventuri Pandasai 0.8.3 Gabrieleventuri Pandasai 0.8.4 Gabrieleventuri Pandasai 1.0 Gabrieleventuri Pandasai 1.0.1 Gabrieleventuri Pandasai 1.0.2 Gabrieleventuri Pandasai 1.0.3 Gabrieleventuri Pandasai 1.0.4 Gabrieleventuri Pandasai 1.0.5 Gabrieleventuri Pandasai 1.0.6 Gabrieleventuri Pandasai 1.0.7 Gabrieleventuri Pandasai 1.0.8 Gabrieleventuri Pandasai 1.0.9 Gabrieleventuri Pandasai 1.0.10 Gabrieleventuri Pandasai 1.0.11 Gabrieleventuri Pandasai 1.1 Gabrieleventuri Pandasai 1.1.1 Gabrieleventuri Pandasai 1.1.2 Gabrieleventuri Pandasai 1.1.3 Gabrieleventuri Pandasai 1.2 Gabrieleventuri Pandasai 1.2.1 Gabrieleventuri Pandasai 1.2.2 Gabrieleventuri Pandasai 1.2.3 Gabrieleventuri Pandasai 1.2.4 Gabrieleventuri Pandasai 1.2.5 Gabrieleventuri Pandasai 1.2.6 Gabrieleventuri Pandasai 1.2.7 Gabrieleventuri Pandasai 1.2.8 Gabrieleventuri Pandasai 1.2.9 Gabrieleventuri Pandasai 1.2.10 Gabrieleventuri Pandasai 1.3 Gabrieleventuri Pandasai 1.3.1 Gabrieleventuri Pandasai 1.3.2 Gabrieleventuri Pandasai 1.3.3 Gabrieleventuri Pandasai 1.4 Gabrieleventuri Pandasai 1.4.1 Gabrieleventuri Pandasai 1.4.2 Gabrieleventuri Pandasai 1.4.3 Gabrieleventuri Pandasai 1.4.5 Gabrieleventuri Pandasai 1.4.6 Gabrieleventuri Pandasai 1.4.7 Gabrieleventuri Pandasai 1.4.8 Gabrieleventuri Pandasai 1.4.9 Gabrieleventuri Pandasai 1.4.10 Gabrieleventuri Pandasai 1.5 Gabrieleventuri Pandasai 1.5.1 Gabrieleventuri Pandasai 1.5.2 Gabrieleventuri Pandasai 1.5.4 Gabrieleventuri Pandasai 1.5.5 Gabrieleventuri Pandasai 1.5.6 Gabrieleventuri Pandasai 1.5.7 Gabrieleventuri Pandasai 1.5.8 Gabrieleventuri Pandasai 1.5.9 Gabrieleventuri Pandasai 1.5.10 Gabrieleventuri Pandasai 1.5.11 Gabrieleventuri Pandasai 1.5.12 Gabrieleventuri Pandasai 1.5.13 Gabrieleventuri Pandasai 1.5.14 Gabrieleventuri Pandasai 1.5.15 Gabrieleventuri Pandasai 1.5.16 Gabrieleventuri Pandasai 1.5.17	115

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

References

https://github.com/gventuri/pandas-ai/issues/868