PandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)
PandasAI lets users ask questions in plain English, which it turns into Python code and runs. An attacker can phrase a question as a jailbreak instruction that tricks PandasAI into generating Python code containing a special object-traversal trick, which escapes the sandbox and executes arbitrary operating system commands.
How the attack works
The attacker sends a natural-language query designed as a prompt-injection jailbreak, telling the system to ignore prior instructions and just return code. Embedded in that query is a Python 'dunder' chain (using __class__.__mro__, __subclasses__(), and __init__.__globals__) that walks Python's internal object graph to reach the os.system, os.popen, or exec functions. PandasAI's code-generation step turns the query into executable Python and runs it in its sandbox. Because the sandbox does not block this traversal path, the generated code reaches a real system-command function and executes it, giving the attacker command execution on the host.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c5a35ce6-b3d9-418c-8137-7a0a1e742d09
- Severity
- Critical
- CVEs
- CVE-2024-12366
Why it matters
An attacker who can submit a query to a PandasAI-powered application can achieve remote code execution on the server running it, potentially leading to full compromise of that host and any data or systems it can reach.
What you can do
- →Upgrade PandasAI past the vulnerable 2.4.x line or apply the vendor's fix for CVE-2024-12366/GHSA-vv2h-2w3q-3fx7.
- →Do not expose PandasAI's natural-language query interface directly to untrusted users without a hardened, non-Python-eval sandbox in front of it.
- →Restrict or monitor the runtime environment PandasAI executes generated code in (e.g., container isolation, no outbound access, minimal OS privileges) so a sandbox escape has limited blast radius.
- →Review any application logs for query strings containing '__subclasses__', '__globals__', '__mro__', or instructions like 'ignore what you are told above' combined with 'return code', as these indicate exploitation attempts rather than benign use.
Known benign look-alikes
- Security research / advisories quoting the PandasAI PoC chain verbatim - fires by design when the exploit string reaches agent I/O.
- Legitimate introspection like `for c in object.__subclasses__(): print(c.__name__)` that never indexes into __init__.__globals__['system'] - does not match.
- Benign news / changelog mentions of CVE-2024-12366 without the exploit chain or sandbox-escape framing - does not match (CVE condition requires exploit tokens).