CVE-2025-1497
Remote Code Execution in PlotAI
- State
- Published
- Severity
- 9.3 Critical
- Published
- Mar 10, 2025
- Updated
- Oct 3, 2025
- Reserved
- Feb 20, 2025
Description
A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
PlotAIMLJAR |
|
References
- https://cert.pl/posts/2025/03/CVE-2025-1497third-party-advisory
- https://cert.pl/en/posts/2025/03/CVE-2025-1497third-party-advisory
- https://github.com/mljar/plotaiproduct
- https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fdepatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.