# PandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)

- **Severity:** Critical
- **Signature ID:** `c5a35ce6-b3d9-418c-8137-7a0a1e742d09`
- **CVEs:** CVE-2024-12366
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

PandasAI lets users ask questions in plain English, which it turns into Python code and runs. An attacker can phrase a question as a jailbreak instruction that tricks PandasAI into generating Python code containing a special object-traversal trick, which escapes the sandbox and executes arbitrary operating system commands.

## How the attack works

The attacker sends a natural-language query designed as a prompt-injection jailbreak, telling the system to ignore prior instructions and just return code. Embedded in that query is a Python 'dunder' chain (using __class__.__mro__, __subclasses__(), and __init__.__globals__) that walks Python's internal object graph to reach the os.system, os.popen, or exec functions. PandasAI's code-generation step turns the query into executable Python and runs it in its sandbox. Because the sandbox does not block this traversal path, the generated code reaches a real system-command function and executes it, giving the attacker command execution on the host.

## Why it matters

An attacker who can submit a query to a PandasAI-powered application can achieve remote code execution on the server running it, potentially leading to full compromise of that host and any data or systems it can reach.

## What you can do

- Upgrade PandasAI past the vulnerable 2.4.x line or apply the vendor's fix for CVE-2024-12366/GHSA-vv2h-2w3q-3fx7.
- Do not expose PandasAI's natural-language query interface directly to untrusted users without a hardened, non-Python-eval sandbox in front of it.
- Restrict or monitor the runtime environment PandasAI executes generated code in (e.g., container isolation, no outbound access, minimal OS privileges) so a sandbox escape has limited blast radius.
- Review any application logs for query strings containing '__subclasses__', '__globals__', '__mro__', or instructions like 'ignore what you are told above' combined with 'return code', as these indicate exploitation attempts rather than benign use.

## Known benign look-alikes

- Security research / advisories quoting the PandasAI PoC chain verbatim - fires by design when the exploit string reaches agent I/O.
- Legitimate introspection like `for c in object.__subclasses__(): print(c.__name__)` that never indexes into __init__.__globals__['system'] - does not match.
- Benign news / changelog mentions of CVE-2024-12366 without the exploit chain or sandbox-escape framing - does not match (CVE condition requires exploit tokens).

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01979
- https://nvd.nist.gov/vuln/detail/CVE-2024-12366

---
Source: https://www.netzilo.com/threats/atr-pandasai-interactive-prompt-injection-python-sandbox-escape