CVE-2025-1497: PlotAI eval vulnerability
A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. PlotAI commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk.
Published Mar 10, 2025 · Updated Oct 3, 2025
Affected packages
plotai
- Ecosystem
- PyPI
- Affected
- < 0.0.7
- Fixed in
- 0.0.7
- Check
pip show plotai
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. PlotAI commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-1497
- https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde
- https://cert.pl/en/posts/2025/03/CVE-2025-1497
- https://cert.pl/posts/2025/03/CVE-2025-1497
- https://github.com/mljar/plotai
- https://github.com/pypa/advisory-database/tree/main/vulns/plotai/PYSEC-2025-22.yaml
- https://github.com/advisories/GHSA-2hmp-5wqg-f24h
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology