CVE-2023-39660: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

August 21, 2023 (updated August 24, 2023)

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.

References

github.com/advisories/GHSA-w832-v3c6-m6rg
github.com/gventuri/pandas-ai/commit/3aac79be8fc1d18b53d66a566adddbbdd2b38ad5
github.com/gventuri/pandas-ai/issues/399
github.com/gventuri/pandas-ai/pull/409
nvd.nist.gov/vuln/detail/CVE-2023-39660

Detect and mitigate CVE-2023-39660 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →