Which versions of Pandasai are affected by CVE-2026-4998?

Sinaptik AI PandasAI versions up to 3.0.0 contain a code injection vulnerability in the Chat Message Handler that allows unauthenticated attackers to execute arbitrary code remotely, with publicly…

Is there a public PoC exploit available for CVE-2026-4998?

Yes, a public proof-of-concept exploit is available for CVE-2026-4998. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4998?

Within 24 hours: Inventory all systems running Sinaptik AI PandasAI up to version 3.0.0 and isolate affected instances from production networks if possible. Within 7 days: Implement network-level access controls to restrict inbound connections to PandasAI services (disable or firewall the Chat Message Handler endpoint); evaluate alternative data analysis tools without this vulnerability. Within 30 days: Either migrate to a patched successor product (contact vendor for timeline), retire PandasAI entirely, or implement application-level request validation and code execution sandboxing if continuation is mandatory.

Pandasai CVE-2026-4998

Q: What is the CVSS score of CVE-2026-4998?

CVE-2026-4998 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-16925 MEDIUM

Code Injection (CWE-94)

2026-03-28 VulDB

RCE Code Injection Pandasai pandas Sinaptik Ai

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 28, 2026 - 13:45 euvd

EUVD-2026-16925

Analysis Generated

Mar 28, 2026 - 13:45 vuln.today

CVE Published

Mar 28, 2026 - 13:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in Sinaptik AI PandasAI up to 3.0.0. This vulnerability affects the function CodeExecutor.execute of the file pandasai/core/code_execution/code_executor.py of the component Chat Message Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Code injection in Sinaptik AI PandasAI versions up to 3.0.0 allows unauthenticated remote attackers to execute arbitrary code via the CodeExecutor.execute function in the Chat Message Handler component. CVSS 7.3 (High) with network attack vector, low complexity, and no authentication required. Publicly available exploit code exists (POC on GitHub Gist). EPSS data not provided, but the combination of unauthenticated remote execution and public exploit significantly elevates real-world risk. Vendor non-responsive to coordinated disclosure.

Technical ContextAI

PandasAI is a Python library that enables conversational interaction with pandas DataFrames using natural language. The vulnerability resides in the CodeExecutor.execute function within pandasai/core/code_execution/code_executor.py, which processes chat messages. CWE-94 (Improper Control of Generation of Code / Code Injection) indicates the application fails to properly sanitize or validate user-supplied input before passing it to a code execution engine. This allows attackers to inject and execute arbitrary Python code within the application's runtime context. The Chat Message Handler component likely accepts user input (natural language queries) and dynamically generates Python code for execution against DataFrames, creating a classic injection surface when input validation is insufficient. The CPE cpe:2.3:a:sinaptik_ai:pandasai identifies all versions up to and including 3.0.0 as affected.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was contacted during coordinated disclosure but did not respond, and remediation level is listed as X (unconfirmed) in CVSS temporal metrics. Organizations using PandasAI up to version 3.0.0 should immediately implement workarounds: (1) isolate PandasAI deployments from untrusted network access using network segmentation or authentication layers; (2) implement strict input validation and sanitization for all chat message inputs before passing to CodeExecutor.execute, employing allowlists for permitted operations; (3) run PandasAI processes with minimal privileges in sandboxed environments (containers, VMs) to limit blast radius of successful code injection; (4) monitor PandasAI GitHub repository (https://github.com/Sinaptik-AI/pandas-ai) for community patches or forks addressing CVE-2026-4998. For detailed vulnerability intelligence, consult VulDB CTI report at https://vuldb.com/vuln/353885/cti. Consider migrating to alternative data analysis frameworks if vendor remains non-responsive or if mission-critical deployments cannot tolerate the risk of unpatched code injection vulnerabilities.