CVE-2025-1497 is a critical code execution flaw (CVSS 9.8) in MLJAR PlotAI, all versions through 0.0.6. It runs Python code produced by a language model without validation. The vendor does not plan a patch, so stop using it or run it only in an isolated sandbox.
What's affected
CERT Polska's advisory, published 10 March 2025, lists the vendor as MLJAR, the product as PlotAI, and the vulnerable versions as all through 0.0.6. The advisory credits a responsible report to CERT Polska.
- Severity: Critical, CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Network reachable, low complexity, no privileges, no user interaction, and high impact on all three security properties.
- Weakness classes: CWE-77 (command injection) and CWE-94 (code injection).
- Fixed version: none. Per the advisory, the vendor commented out the vulnerable line and does not plan to release a patch.
- Exploitation in the wild: not in CISA KEV, and the advisory does not report it.
The vendor's position is stated in a single sentence in the advisory: further use of the software requires uncommenting the line, and so accepting the risk. In plain terms, the safe default is that the dangerous behavior is switched off, and turning it on is the user's decision.
How to check if you're exposed
First find out whether PlotAI is installed anywhere you run Python.
pip show plotai
pip list 2>/dev/null | grep -i plotai
# Across a repository
grep -rni "plotai" requirements*.txt pyproject.toml Pipfile* poetry.lock 2>/dev/null
If it is present at version 0.0.6 or lower, you are in the range. Then look at your copy of the package source to see whether the line the vendor commented out has been restored, either by you or by a fork. The advisory does not name the line, so read the project's repository and the commit linked from the CVE record.
The free in-browser dependency scan can list the package from a requirements or lock file. Reachability analysis helps to tell whether your application calls the affected path or only has the package installed.
What to do now
- Find every project, notebook and container image that installs PlotAI.
- If the line is still commented out in your version, do not uncomment it.
- If you rely on the behavior that needs the line, stop, or move the workload into a sandbox with no network access, no secrets and no access to production data.
- Never run model written code on a machine that holds credentials.
- Look for a replacement tool that does not execute generated code directly, or a design that reviews the code before it runs.
- Remove the package from images and lock files where it is not needed.
- Record the decision, because the vendor will not issue a patch.
Why it matters
The weakness is simple to state. The program asks a language model to write Python, and then runs what comes back. Nothing checks that code. CWE-94 is the class for code that is built from outside input and then executed, and CWE-77 covers the related case of commands. A language model's output is influenced by the prompt, the data and sometimes content from third parties, so it should be treated as untrusted input, like anything a user types.
This is a design problem, not a typo. A patch can comment out a line, but the idea of running generated code directly stays risky. That is why the vendor's answer leaves the decision with the user.
The lesson reaches beyond this package. Any tool that executes model output needs a sandbox, an allow list of operations or a human review step.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Will there be a patch for CVE-2025-1497?
The CERT Polska advisory says the vendor does not plan to release one. The vendor commented out the vulnerable line instead.
Am I safe if I never uncomment the line?
According to the advisory, the vendor disabled the risky behavior by commenting out the line, and further use requires uncommenting it. Confirm in your installed copy, and keep model written code away from machines that hold secrets.
Sources
Last reviewed: 19 October 2026.
