CVE-2023-39661: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

August 15, 2023 (updated August 22, 2023)

An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.

References

github.com/advisories/GHSA-8fp9-43pw-56vw
github.com/gventuri/pandas-ai/issues/410
nvd.nist.gov/vuln/detail/CVE-2023-39661

Detect and mitigate CVE-2023-39661 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →