Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

pandas-ai 3.0.0 may execute unwanted code

CVE-2026-51898 · published 16 days ago
Summary

The pandas-ai version 3.0.0 from sinaptik‑ai contains a weakness that could let an attacker insert and run their own commands when the program processes certain inputs. This could lead to unauthorized actions on your system or data loss. Update to a newer, patched version or apply the vendor's recommended fix as soon as possible.

Original advisory text
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-51898 · NVD
CVE-2026-51898 · MITRE
Track software like this
Free during beta