CVE-2024-23752: Missing Authorization

January 22, 2024 (updated January 29, 2024)

GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.

References

github.com/advisories/GHSA-5g73-69p4-7gvx
github.com/gventuri/pandas-ai/issues/868
nvd.nist.gov/vuln/detail/CVE-2024-23752

Code Behaviors & Features

Detect and mitigate CVE-2024-23752 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →