MindsDBGHSA-crmg-rp64-5cm3
MindsDB Eval Injection vulnerability
High8.8CVE-2024-45847 · Published Sep 12, 2024 · updated Jul 7, 2026
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mindsdb PyPI | >= 23.11.4.2, < 24.7.4.1 | 24.7.4.1 |
Details and references
More MindsDB advisories
All MindsDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 122024 | MindsDB Cross-site Scripting vulnerability Medium9.0Sep 12, 2024 | Medium9.0 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh7.1Sep 12, 2024 | High7.1 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh8.8Sep 12, 2024 | High8.8 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh7.1Sep 12, 2024 | High7.1 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh7.1Sep 12, 2024 | High7.1 | No fix yet |
| Sep 122024 | MindsDB Eval Injection vulnerabilityHigh8.8Sep 12, 2024 | High8.8 | 24.7.4.1 |