The vulnerability allows arbitrary code to be executed through the CodeExecutor.execute function in pandas‑ai 3.0.0, potentially compromising confidentiality, integrity, and availability of data processed by the application. The CVSS score is 9.8, indicating critical severity. The description does not detail the exact mechanics of the injection, so the extent of possible damage remains uncertain but could be severe.

Applications that incorporate the sinaptik‑ai pandas‑ai 3.0.0 library are affected. The issue resides specifically in the CodeExecutor.execute component of the library, and any system that imports and calls this function is potentially vulnerable.

The likely attack vector is a developer or user invoking CodeExecutor.execute with malicious input; it is inferred that successful exploitation would require the ability to pass arbitrary strings to this function. With a CVSS score of 9.8 indicating critical severity, the vulnerability represents a high risk to confidentiality, integrity, and availability. The EPSS score is < 1 %, showing a low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. Without a patch, the risk remains high in any environment that uses the affected library component.