This vulnerability affects the pandasai-lancedb extension of Sinaptik AI PandasAI (versions 0.1.0 through 0.1.4). Specifically, the functions delete_question_and_answers, delete_docs, update_question_answer, update_docs, get_relevant_question_answers_by_id, and get_relevant_docs_by_id in the file extensions/ee/vectorstores/lancedb/pandasai_lancedb/lancedb.py are vulnerable to SQL injection. An attacker can remotely exploit this issue to manipulate SQL queries, potentially compromising the integrity and confidentiality of the underlying database. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The vendor has not issued any response or patch, and no official remediation is available at this time.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database used by the pandasai-lancedb extension. This could lead to unauthorized data access, modification, or deletion. Given the medium CVSS score and the lack of vendor response, the risk remains significant for users of affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix has been provided and the vendor has not responded, users should consider mitigating exposure by restricting access to the vulnerable functions or the affected service until a fix is available. Monitoring for updates from the vendor or community advisories is recommended.