Remote Code Execution Vulnerability in PlotAI by MLJAR

CVE-2025-1497

What is CVE-2025-1497?

A notable vulnerability has been identified in PlotAI, where inadequate validation of outputs generated by the language model (LLM) allows an attacker to execute arbitrary Python code remotely. Although the vendor has commented out the vulnerable line of code, resuming use of the software necessitates uncommenting this line, thereby accepting the associated risks. Notably, there are no plans for the vendor to issue a patch to address this critical security concern.

References