PandasAI interactive prompt function Remote Code Execution (RCE)

The impact of CVE-2024-12366 is severe. An attacker can leverage prompt injection to bypass security measures and execute arbitrary Python code within the pandasai environment. This could lead to complete system compromise, allowing the attacker to steal sensitive data, install malware, or pivot to other connected systems. The ability to execute arbitrary code effectively grants the attacker full control over the affected system. This vulnerability shares similarities with other prompt injection attacks targeting large language model integrations, highlighting the importance of robust input validation and security controls.

Organizations and developers using pandasai in production environments, particularly those integrating it with sensitive data or critical systems, are at significant risk. Those relying on pandasai for automated data analysis or report generation are especially vulnerable, as they may not be actively monitoring prompts for malicious content. Users with limited security expertise or those who have not implemented robust input validation practices are also at higher risk.

• python / supply-chain:

import pandas as pd
import pandasai

# Check pandasai version
print(pandasai.__version__)

# Attempt to detect malicious code execution by injecting a simple prompt
# (This is a simplified example and may require more sophisticated techniques)
# pandasai.with_chat_session().run('print("Malicious code executed")')

• generic web: Check for unusual process activity related to pandasai. Monitor system logs for unexpected Python script executions. • generic web: Review pandasai configuration files for any suspicious modifications or injected code.

1. 2025-02-11Disclosure

   disclosure

1. 已保留2024-12-09
2. 发布日期2025-02-11
3. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-12366 is to upgrade pandasai to version 2.4.1 or later. This version includes fixes to properly validate and sanitize user inputs, preventing malicious code execution. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization on all prompts passed to pandasai. While not a complete solution, this can reduce the attack surface. Review and restrict the permissions granted to the pandasai process to limit the potential damage from a successful exploit. After upgrading, verify the fix by attempting to inject a simple, known malicious prompt and confirming that it is properly rejected.