Search for packages
| purl | pkg:pypi/pandasai@0.2.4 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2023-39661
Aliases: GHSA-8fp9-43pw-56vw |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') An issue in pandas-ai v.0.9.1 and before … |
Vulnerable |
|
PYSEC-2026-446
Aliases: CVE-2024-23752 GHSA-5g73-69p4-7gvx |
Code execution in pandasai GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of … | There are no reported fixed by versions. |
|
PYSEC-2026-448
Aliases: CVE-2024-12366 GHSA-vv2h-2w3q-3fx7 |
PandasAI interactive prompt function Remote Code Execution (RCE) PandasAI uses an interactive prompt function that is vulnerable to prompt injection … | There are no reported fixed by versions. |
|
PYSEC-2026-447
Aliases: CVE-2023-39661 GHSA-8fp9-43pw-56vw |
PandasAI vulnerable to arbitrary code execution An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary … | There are no reported fixed by versions. |
|
CVE-2026-30273
|
SQL Injection via _execute_sql_query component pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component. | There are no reported fixed by versions. |
|
PYSEC-2026-1757
Aliases: CVE-2023-39660 GHSA-w832-v3c6-m6rg |
pandasai vulnerable to prompt injection An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute … |
Vulnerable |