Arbitrary Command Execution Affecting pandas package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Command Execution vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-PANDAS-8549481
- published25 Dec 2024
- disclosed24 Dec 2024
- creditAftersnows@360
Introduced: 24 Dec 2024
NewCVE-2024-9880 (opens in a new tab)How to fix?
There is no fixed version for pandas.
Overview
pandas is a Python package providing data structures designed to make working with structured (tabular, multidimensional, potentially heterogeneous) and time series data both easy and intuitive.
Affected versions of this package are vulnerable to Arbitrary Command Execution in the pandas.DataFrame.query() function, which is commonly exposed by applications to accept user input. Code can be injected into a Python expression, which will be executed with the privileges of the application.
PoC
@pd.core.frame.com.builtins.__import__("os").system("""ping google.com #""")