CVE-2023-39660: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

August 21, 2023 (updated August 24, 2023)

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.

References

github.com/advisories/GHSA-w832-v3c6-m6rg
github.com/gventuri/pandas-ai/commit/3aac79be8fc1d18b53d66a566adddbbdd2b38ad5
github.com/gventuri/pandas-ai/issues/399
github.com/gventuri/pandas-ai/pull/409
nvd.nist.gov/vuln/detail/CVE-2023-39660

Code Behaviors & Features

Detect and mitigate CVE-2023-39660 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →