CVE-2025-1497

CRITICAL

PlotAI < 0.0.7 - Remote Code Execution via Unvalidated LLM Output

Title source: llm
STIX 2.1

Description

A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.0095
EPSS Percentile 56.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-77 CWE-94
Status published
Products (2)
mljar/plotai < 0.0.7
pypi/plotai 0 - 0.0.7PyPI
Published Mar 10, 2025
Tracked Since Feb 18, 2026