AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MindsDBGHSA-wcjw-3v6p-4v3r

MindsDB Eval Injection vulnerability

MindsDB

CVE-2024-45846 · Published Sep 12, 2024 · updated Sep 16, 2024

High8.8
Fix: upgrade to 24.7.4.1 or later
GitHub advisory

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.

Affected versions

PackageAffectedFixed in
mindsdb
PyPI
>= 23.10.3.0, < 24.7.4.124.7.4.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-94, CWE-95
Also known as
CVE-2024-45846, PYSEC-2024-77

More MindsDB advisories

All MindsDB
Medium 9.0Sep 12, 2024MindsDB Cross-site Scripting vulnerabilityCVE-2024-45856no fix yetHigh 7.1Sep 12, 2024MindsDB Deserialization of Untrusted Data vulnerabilityCVE-2024-45854no fix yetHigh 8.8Sep 12, 2024MindsDB Deserialization of Untrusted Data vulnerabilityCVE-2024-45852no fix yetHigh 7.1Sep 12, 2024MindsDB Deserialization of Untrusted Data vulnerabilityCVE-2024-45855no fix yetHigh 7.1Sep 12, 2024MindsDB Deserialization of Untrusted Data vulnerabilityCVE-2024-45853no fix yetHigh 8.8Sep 12, 2024MindsDB Eval Injection vulnerabilityCVE-2024-45851fixed in 24.7.4.1