PandasAI Code Injection Vulnerability (CVE-2026-4998)

A critical code injection vulnerability, identified as CVE-2026-4998, has been discovered in Sinaptik AI PandasAI versions up to 3.0.0. This flaw resides within the CodeExecutor.execute function in the pandasai/core/code_execution/code_executor.py file, part of the Chat Message Handler component. An attacker can exploit this weakness by sending crafted input that leads to the injection and execution of arbitrary code on the target system. The vulnerability is remotely exploitable, meaning no local access is required. Publicly available exploit code exists, increasing the risk of widespread exploitation. The vendor was notified but did not respond. This vulnerability poses a significant risk to systems using vulnerable versions of PandasAI, potentially leading to complete system compromise.

Attack Chain

1. The attacker identifies a PandasAI instance running a version prior to or equal to 3.0.0.
2. The attacker crafts a malicious input designed to be processed by the Chat Message Handler.
3. This input is sent to the vulnerable CodeExecutor.execute function.
4. The CodeExecutor.execute function fails to properly sanitize the input.
5. The malicious input is interpreted as code.
6. The injected code is executed within the context of the PandasAI application.
7. The attacker gains control over the server or application.
8. The attacker may then escalate privileges, install malware, or exfiltrate sensitive data.

Impact

Successful exploitation of CVE-2026-4998 allows a remote attacker to execute arbitrary code on the system running PandasAI. This could lead to a full system compromise, including data theft, modification, or destruction. The availability of public exploit code makes this vulnerability particularly dangerous, as it lowers the barrier to entry for attackers. Organizations using PandasAI in production environments are at high risk.

Recommendation

• Upgrade PandasAI to a version greater than 3.0.0 to patch CVE-2026-4998.
• Monitor web server logs for suspicious POST requests to endpoints associated with the Chat Message Handler, specifically looking for unusual characters or code-like syntax in the request body. Use the Sigma rule Detect PandasAI Code Injection Attempt to identify potential exploitation attempts.
• Implement input validation and sanitization measures within PandasAI to prevent code injection, even if a patch is not immediately available.
• Deploy the Sigma rule Detect PandasAI Code Injection Execution to identify successful code execution attempts.