pandas-ai: Code injection via LLM-generated code in CodeExecutor.execute

Summary

pandas-ai version 3.0.0 contains a code injection flaw in CodeExecutor.execute, which executes LLM-generated code directly with exec() without sandbox isolation in the default configuration. An attacker who can submit crafted natural language queries may be able to run arbitrary code on the host, including file access, command execution and network access. Exploitation requires that untrusted input reaches the LLM prompt; the CVSS score is 9.8 (critical).

Affected

• pandas-ai 3.0.0 (per CVE record)
• Other versions: Unknown.

Fixed in

Unknown. No vendor fix or release found at the time of research.

Workaround

• Configure a sandbox explicitly, as the default configuration (sandbox=None) provides no isolation (third-party analysis, unverified).
• Run the service in a container or VM with least privilege, no access to production secrets and restricted network egress.
• Keep untrusted users and data sources away from the agent until a vendor fix is confirmed.

Exploitation

• CISA SSVC: Exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV.
• A public gist by the reporter is referenced; its contents were not verified.
• VulDB states no available exploit.
• No known exploitation in the wild found.

Our recommendation

• Inventory all pandas-ai installations and versions, including transitive dependencies.
• Take internet-facing or untrusted-input deployments offline or restrict them until a sandbox is configured.
• Monitor GitHub issue #1893, releases and NVD for a vendor fix or advisory.
• Monitor logs for unexpected code execution.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-51898 Gist (reporter) gist.github.com
• pandas-ai Issue #1893 github.com
• OpenCVE CVE-2026-51898 app.opencve.io
• VulDB 413153 vuldb.com
• pandas-ai Security page github.com
• Strix CVE-2026-51898 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:24.