Sinaptik AI PandasAI up to version 3.0.0 contains a path traversal vulnerability in the is_sql_query_safe function located in pandasai/helpers/sql_sanitizer.py. This vulnerability allows an unauthenticated remote attacker to manipulate input to traverse file system paths, potentially accessing unauthorized files. The vulnerability is identified as CVE-2026-4997 with a CVSS 4.0 score of 6.9 (medium severity). The vendor was notified but has not issued a response or patch. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow remote attackers to access or read files outside the intended directory structure of the application, potentially exposing sensitive information. However, there is no indication of privilege escalation or code execution. The impact is limited to information disclosure via path traversal.

No official patch or fix is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting network access to the affected application and applying compensating controls such as input validation or sandboxing to limit the impact of path traversal attempts.