EUVD-2026-91705
GHSA-whj7-cr8f-v2cc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 3.1 rates this 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - network, low-complexity, unauthenticated code injection (CWE-94) with full confidentiality, integrity and availability impact, consistent with remote code execution. However, the EPSS probability is only 0.16% (4th percentile), and the CVE is NOT on the CISA KEV list, so there is no evidence of active or widespread exploitation despite the high base score. The two references (a project GitHub issue and a public gist) strongly imply public exploit/PoC code exists, which raises the practical threat, but PoC availability is a distinct signal from active exploitation and must not be conflated. The most important caveat is a signal conflict: pandas-ai is a LIBRARY whose CodeExecutor.execute runs LLM-generated Python by design, so the PR:N/AV:N 9.8 vector only holds when the library is wired into an application that feeds untrusted user input into the pipeline with sandboxing disabled - in a closed/internal analytics deployment the real-world attack surface is far smaller than the base score suggests. No SSVC decision data was provided. Net assessment: a genuinely severe RCE-class flaw worth prompt patching for anyone exposing pandas-ai to untrusted input, but the low EPSS and absence of KEV indicate it is not currently seeing broad opportunistic exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Arbitrary Python code execution in sinaptik-ai pandas-ai 3.0.0 allows remote, unauthenticated attackers to run attacker-controlled code through the CodeExecutor.execute path, giving full compromise of the host or container running the agent. The flaw is rated CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-94 code injection, meaning no privileges, credentials or user interaction are required per the assessed vector. EPSS is low at 0.16% (4th percentile) and there is no CISA KEV entry, so no public exploit identified at time of analysis, although a GitHub issue and a public gist referencing the bug are linked from the CVE record and should be reviewed as possible reproduction detail.
RemediationAI
No vendor-released patch identified in the available data at time of analysis, and the referenced upstream GitHub issue (https://github.com/sinaptik-ai/pandas-ai/issues/1893) is a disclosure thread rather than a confirmed tagged fix; teams should track that issue and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-51898 for an applicable release before assuming 3.0.0 is safe. Until a fix ships, treat pandas-ai 3.0.0 as an exposed code-execution service: do not expose the agent's prompt/query endpoint to untrusted networks, place it behind authentication and network allowlisting, and run the process as an unprivileged user inside a disposable container with a read-only root filesystem, dropped Linux capabilities and no outbound network egress (the egress block prevents exfiltration and payload download but will break legitimate calls to external LLM APIs, so route those through a broker instead). Where the code-execution path is not essential, disable or replace the LLM code-generation/execution flow entirely and use deterministic, non-executing data queries; if execution must remain, apply pre-execution validation of generated code with an AST/allowlist sandbox (restricted builtins, blocked imports of os, subprocess, socket) and accept the trade-off that aggressive sandboxing will break some legitimate generated analysis scripts. Monitor and log every CodeExecutor.execute invocation with the full generated source for forensic triage, and treat any pandas-ai deployment that processed untrusted natural-language input as potentially compromised, requiring credential rotation for any secrets reachable from that process.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pandas-ai (PandasAI) is an LLM-driven data-analysis library that converts natural-language questions into pandas/Python code and then executes that generated code on the user's behalf. The vulnerable component is CodeExecutor.execute, the execution primitive that runs LLM-generated or user-influenced code; CWE-94 (Improper Control of Generation of Code) is the root-cause class, meaning untrusted input reaches a code-generation/execution sink without adequate validation, sanitization or sandbox confinement. That maps directly onto the assessed CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - network reachable, low complexity, no privileges or user interaction required, with full confidentiality, integrity and availability impact, consistent with remote code execution. The central risk is architectural: PandasAI's design intentionally emits and evaluates Python, so any deployment that exposes the agent (as an API, web service, notebook backend or shared internal tool) effectively exposes a Python interpreter to whoever can reach the prompt entry point. CPE data supplied for this CVE is a placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and EUVD lists affected versions as "n/a n/a", so the authoritative version signal remains the description and product line: pandas-ai 3.0.0. ENISA EUVD tracks the issue as EUVD-2026-91705, reported via MITRE/cveorg, and tags it RCE / Code Injection.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
Executive ViewAI
Organizations that embed sinaptik-ai's pandas-ai 3.0.0 in analytics or AI agent workflows face a critical unauthenticated remote code execution flaw that can give an attacker full control of the host or container running the agent. Exposure is not universal: risk concentrates in deployments reachable from untrusted networks or that process untrusted prompts, files or model output through the code execution path. Because no vendor patch is currently available, leadership should treat this as a scoping and containment problem - confirm where the library runs and whether those systems are internet-facing - rather than a routine patching task.
No vendor-released patch identified at time of analysis. Interim mitigations: remove pandas-ai 3.0.0 hosts from untrusted network reach (deny inbound at firewall/load balancer); disable or remove the CodeExecutor.execute path where not operationally required; run agents in hardened, non-root, read-only, egress-restricted containers with no host mounts; strip cloud instance credentials and high-value secrets from those environments and rotate any that were exposed; validate all prompts, files and model output before they reach code-bearing paths; and enable monitoring/alerting for subprocess execution, unexpected outbound traffic and file writes on affected hosts. Note: no public exploit identified at time of analysis, and publicly available exploit code exists only as a GitHub issue and gist referenced in the CVE record.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB