Homepage
About Snyk

pandasai@2.0a2 vulnerabilities

Chat with your database (SQL, CSV, pandas, polars, mongodb, noSQL, etc). PandasAI makes data analysis conversational using LLMs (GPT 3.5 / 4, Anthropic, VertexAI) and RAG.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the pandasai package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Control of Generation of Code ('Code Injection')

pandasai is a Pandas AI is a Python library that integrates generative artificial intelligence capabilities into Pandas, making dataframes conversational.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the GenerateSDFPipeline function in the synthetic_dataframe module. An attacker can execute arbitrary Python code by loading maliciously crafted dataframe content.

How to fix Improper Control of Generation of Code ('Code Injection')?

Upgrade pandasai to version 2.0 or higher.

[1.5.0,2.0)
  • M
Arbitrary Code Execution

pandasai is a Pandas AI is a Python library that integrates generative artificial intelligence capabilities into Pandas, making dataframes conversational.

Affected versions of this package are vulnerable to Arbitrary Code Execution via the _is_jailbreak function.

How to fix Arbitrary Code Execution?

There is no fixed version for pandasai.

[0,)
Go back to all versions of this package