CVE-2024-23752 in PandasAI
Summary
by MITRE • 01/22/2024
GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE: the vendor previously attempted to restrict code execution in response to a separate issue, CVE-2023-39660.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/31/2025
The vulnerability CVE-2024-23752 affects the synthetic_dataframe module within PandasAI version 1.5.17 and earlier, specifically targeting the GenerateSDFPipeline functionality. This issue represents a critical code execution flaw that arises from the system's inability to properly sanitize user inputs when generating synthetic dataframes. The vulnerability stems from the software's design to interpret natural language specifications provided by users and translate them into executable Python code through the SDFCodeExecutor component. When an attacker crafts a malicious dataframe containing specially formatted English language instructions, the system processes these inputs without adequate validation, leading to arbitrary code execution on the target system.
The technical flaw manifests in the improper handling of user-provided data that is intended to describe synthetic data generation parameters. The GenerateSDFPipeline component accepts user input that includes natural language specifications for data generation, which are then parsed and converted into Python code for execution. This conversion process lacks sufficient input validation and sanitization mechanisms, allowing attackers to inject malicious Python code snippets within what appears to be legitimate data description fields. The vulnerability is particularly concerning because it operates at the intersection of natural language processing and code generation, creating a complex attack surface where seemingly benign user inputs can be transformed into harmful system commands. The SDFCodeExecutor component serves as the execution engine that runs the generated Python code, making it the final point where the attacker's malicious payload is realized.
The operational impact of this vulnerability is severe and multifaceted, potentially allowing attackers to execute arbitrary commands on systems running vulnerable versions of PandasAI. An attacker could leverage this vulnerability to gain full system access, install malware, exfiltrate sensitive data, or perform other malicious activities. The vulnerability's persistence across multiple versions suggests a fundamental design flaw in the code generation pipeline that has not been adequately addressed despite previous attempts to restrict code execution. The fact that the vendor previously attempted to address similar issues in CVE-2023-39660 indicates that this represents an ongoing challenge in securing code generation components within data processing frameworks. The vulnerability affects any system where PandasAI is deployed and used for generating synthetic data, making it particularly dangerous in enterprise environments where data processing pipelines are extensively utilized.
Mitigation strategies for CVE-2024-23752 should focus on implementing robust input validation and sanitization mechanisms within the synthetic dataframe generation pipeline. Organizations should immediately upgrade to the latest version of PandasAI where this vulnerability has been addressed, as the vendor has likely implemented proper code execution restrictions. Network segmentation and access controls should be implemented to limit exposure of systems running vulnerable versions of the library. Additionally, implementing strict input filtering mechanisms that validate all user-provided specifications before code generation can help prevent malicious payloads from being executed. Security teams should monitor for any attempts to exploit this vulnerability through anomalous code generation requests or unusual data processing patterns. The implementation of sandboxing techniques for code execution and the use of least privilege principles for the SDFCodeExecutor component can significantly reduce the potential impact of successful exploitation attempts. This vulnerability aligns with CWE-74 and CWE-94 categories related to code injection and improper restriction of operations within a recognized interface, and it maps to ATT&CK techniques involving command and scripting interpreter execution and privilege escalation through code injection.