CVE-2024-12366
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Feb 11, 2025
Summary
CVE-2024-12366 is a critical vulnerability affecting the PandasAI application. Instead of just explaining natural language processing, the interactive prompt function in PandasAI is susceptible to prompt injection attacks. An attacker who successfully executes such an attack can run arbitrary Python code, resulting in Remote Code Execution (RCE), bypassing the intended security measures. This issue poses a significant risk to users and requires immediate mitigation efforts from the developers.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.