MindsDBGHSA-v6g6-3cm3-vf6c
MindsDB Eval Injection vulnerability
High8.8CVE-2024-45850 · Published Sep 12, 2024 · updated Sep 16, 2024
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for site column creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mindsdb PyPI | >= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
Details and references
More MindsDB advisories
All MindsDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 122024 | MindsDB Cross-site Scripting vulnerability Medium9.0Sep 12, 2024 | Medium9.0 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh7.1Sep 12, 2024 | High7.1 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh8.8Sep 12, 2024 | High8.8 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh7.1Sep 12, 2024 | High7.1 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerabilityHigh7.1Sep 12, 2024 | High7.1 | No fix yet |
| Sep 122024 | MindsDB Eval Injection vulnerabilityHigh8.8Sep 12, 2024 | High8.8 | 24.7.4.1 |