AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MindsDBGHSA-93c5-rj2p-w52x

Cross-site Scripting (XSS) in mindsdb/mindsdb

MindsDB

CVE-2024-3575 · Published Apr 16, 2024 · updated Jun 6, 2026

Medium5.8
No fix yet
GitHub advisory

When a user uploads a csv file that contains an javascript payload a Cross-site Scripting (XSS) is triggered when the file is viewed. This is true for both cloud version and OSS version.

Affected versions

PackageAffectedFixed in
mindsdb
PyPI
<= 23.6.3.1No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2024-3575, PYSEC-2024-288

More MindsDB advisories

All MindsDB
High 8.8Sep 12, 2024MindsDB Eval Injection vulnerabilityCVE-2024-45846fixed in 24.7.4.1High 8.8Sep 12, 2024MindsDB Eval Injection vulnerabilityCVE-2024-45850fixed in 24.7.4.1High 9.3Sep 5, 2024MindsDB Vulnerable to Bypass of SSRF Protection with DNS RebindingCVE-2024-24759fixed in 23.12.4.2High 9.1Dec 15, 2023GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182CVE-2023-50731fixed in 23.11.4.1Medium 5.3Dec 12, 2023Improper Input Validation in mindsdbCVE-2023-49796fixed in 23.11.4.1Medium 6.5Dec 12, 2023Server-Side Request Forgery in mindsdbCVE-2023-49795fixed in 23.11.4.1