pandasai vulnerable to prompt injection
Date: 2023-08
Affected: pip/pandasai
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-39660
CWE: CWE-94

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.


Mitigations:

Architectural layers (MAESTRO):