This vulnerability in Sinaptik AI PandasAI up to version 3.0.0 involves the CodeExecutor.execute function in the pandasai/core/code_execution/code_executor.py file. An attacker can remotely manipulate this function to perform code injection, potentially executing arbitrary code on the affected system. The vulnerability is publicly disclosed with exploit code available, but the vendor has not provided any response or patch. The CVSS 4.0 score is 6.9, indicating a medium severity risk with network attack vector and no required privileges or user interaction.

Successful exploitation allows remote attackers to inject and execute arbitrary code within the context of the vulnerable application, potentially compromising system integrity and confidentiality. However, there are no reports of active exploitation in the wild at this time. The lack of vendor response and patch increases the risk for affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying workarounds such as restricting network access to the vulnerable component or disabling the affected functionality if feasible until a patch is released.