Code Injection in Pandas-AI 3.0.0

Executive Summary

This is a code injection vulnerability in pandas-ai version 3.0.0. It affects the CodeExecutor.execute function which runs LLM-generated Python code directly using exec() without sandboxing or input validation. By default, the sandbox is disabled, allowing arbitrary code execution on the host system.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if pandas-ai version 3.0.0 is installed and verify if the CodeExecutor.execute function in pandasai/core/code_execution/code_executor.py is present without sandboxing. Look for unexpected file creations or system commands in logs, such as files named /tmp/pandasai_rce_proof.txt.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious commands on your system. This includes creating, reading, modifying, or deleting files, executing system commands, accessing sensitive data, or exfiltrating information over the network. The impact depends on the system's permissions and configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or data exfiltration, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this software may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade pandas-ai to a patched version if available. If not, disable or remove pandas-ai 3.0.0. Enable sandboxing for the CodeExecutor.execute function if possible. Monitor system logs for suspicious activity and restrict access to the application.

Useful 0 Not Useful 0