CVE-2026-4996

A vulnerability was identified in Sinaptik AI PandasAI up to 0.1.4. Affected by this issue is the function delete_question_and_answers/delete_docs/update_question_answer/update_docs/get_relevant_question_answers_by_id/get_relevant_docs_by_id of the file extensions/ee/vectorstores/lancedb/pandasai_lancedb/lancedb.py of the component pandasai-lancedb Extension. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-74
• CWE-89

• https://gist.github.com/YLChen-007/e33f76941234bed3824181ed252bd09f
• https://vuldb.com/?ctiid.353883
• https://vuldb.com/?id.353883
• https://vuldb.com/?submit.778268

Published

Mar 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49954Discuz! X5.0 releases 20260320 through 20260610 contain a lo…8.6
• CVE-2026-49955Hermes WebUI before version 0.51.270 contains a resource exh…6.9
• CVE-2026-49956Hermes WebUI before version 0.51.269 contains a profile isol…7.1
• CVE-2026-49957Hermes WebUI before version 0.51.296 contains a workspace bo…7.7
• CVE-2026-49958Hermes WebUI before version 0.51.303 contains a time-of-chec…5
• CVE-2026-49959Hermes WebUI before version 0.51.311 contains a remote code …8.8
• CVE-2026-49969Laravel-Mediable before 7.0.0 contains a server-side request…7.4
• CVE-2026-4997A security flaw has been discovered in Sinaptik AI PandasAI …5.5
• CVE-2026-49970Laravel-Mediable before 7.0.0 contains a path traversal vuln…8.8
• CVE-2026-49971Laravel-Mediable before 7.0.0 contains a stored cross-site s…6.1
• CVE-2026-49972Laravel-Mediable before 7.0.0 contains a file upload vulnera…8.8
• CVE-2026-49973Hermes WebUI before version 0.51.358 contains an improper ac…9.4