Critical severity9.8NVD Advisory· Published Jan 22, 2024· Updated Jun 17, 2026
CVE-2024-23752
CVE-2024-23752
Description
GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pandasaiPyPI | <= 1.5.17 | — |
Affected products
3- PandasAI/pandas-aidescription
Patches
Vulnerability mechanics
References
3- github.com/gventuri/pandas-ai/issues/868nvdExploitMailing ListVendor AdvisoryWEB
- github.com/advisories/GHSA-5g73-69p4-7gvxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-23752ghsaADVISORY
News mentions
0No linked articles in our index yet.