PandasAI interactive prompt function Remote Code Execution (RCE)
PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM. The security controls of PandasAI (2.4.3 and earlier) fail to distinguish between legitimate and malicious inputs, allowing the attackers to manipulate the system into executing untrusted code, leading to untrusted code execution (RCE), system compromise, or pivoting attacks on connected services.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | pandasai | <= 2.4.2 | no fix |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-12366
- https://docs.getpanda.ai/v3/privacy-security
- https://docs.pandas-ai.com/advanced-security-agent
- https://github.com/sinaptik-ai/pandas-ai
- https://www.kb.cert.org/vuls/id/148244
- https://pypi.org/project/pandasai
- https://github.com/advisories/GHSA-vv2h-2w3q-3fx7
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-94- Platform
- Python (PyPI)
- Package
pandasai- Disclosed
- 11.02.2025
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-448 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vv2h-2w3q-3fx7 - CC BY 4.0
Vulnerability history: pandasai
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 08.2023 02.2025
- Without a fix
- 3
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 1
Disclosures per year
- 2023: 2
- 2024: 1
- 2025: 1
- 2026: 0
-
PandasAI interactive prompt function Remote Code Execution (RCE) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.