MindsDB security advisories
23 advisories · 2 critical or high in 12 months · latest May 4
23 advisories
| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 4 | MindsDB has an Improper Access Control Issue CVE-2026-7711Medium7.3no fix yet | Medium7.3 | No fix yet |
| Feb 24 | MindsDB: Path Traversal in /api/files Leading to Remote Code Execution CVE-2026-27483High8.8fixed in 25.9.1.1 | High8.8 | 25.9.1.1 |
| Feb 16 | MindsDB affected by a SSRF vulnerability CVE-2026-2531Low6.3no fix yet | Low6.3 | No fix yet |
| Jan 12 | MindsDB has improper sanitation of filepath that leads to information disclosure and DOS CVE-2025-68472High8.1fixed in 25.11.1 | High8.1 | 25.11.1 |
| Sep 122024 | MindsDB Cross-site Scripting vulnerability CVE-2024-45856Medium9.0no fix yet | Medium9.0 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45854High7.1no fix yet | High7.1 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45852High8.8no fix yet | High8.8 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45855High7.1no fix yet | High7.1 | No fix yet |
| Sep 122024 | MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45853High7.1no fix yet | High7.1 | No fix yet |
| Sep 122024 | MindsDB Eval Injection vulnerability CVE-2024-45851High8.8fixed in 24.7.4.1 | High8.8 | 24.7.4.1 |
| Sep 122024 | MindsDB Eval Injection vulnerability CVE-2024-45848High8.8fixed in 24.7.4.1 | High8.8 | 24.7.4.1 |
| Sep 122024 | MindsDB Eval Injection vulnerability CVE-2024-45849High8.8fixed in 24.7.4.1 | High8.8 | 24.7.4.1 |
| Sep 122024 | MindsDB Eval Injection vulnerability CVE-2024-45847High8.8fixed in 24.7.4.1 | High8.8 | 24.7.4.1 |
| Sep 122024 | MindsDB Eval Injection vulnerability CVE-2024-45850High8.8fixed in 24.7.4.1 | High8.8 | 24.7.4.1 |
| Sep 122024 | MindsDB Eval Injection vulnerability CVE-2024-45846High8.8fixed in 24.7.4.1 | High8.8 | 24.7.4.1 |
| Sep 52024 | MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding CVE-2024-24759High9.3fixed in 23.12.4.2 | High9.3 | 23.12.4.2 |
| Apr 162024 | Cross-site Scripting (XSS) in mindsdb/mindsdb CVE-2024-3575Medium5.8no fix yet | Medium5.8 | No fix yet |
| Dec 152023 | GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182 CVE-2023-50731High9.1fixed in 23.11.4.1 | High9.1 | 23.11.4.1 |
| Dec 122023 | Improper Input Validation in mindsdb CVE-2023-49796Medium5.3fixed in 23.11.4.1 | Medium5.3 | 23.11.4.1 |
| Dec 122023 | Server-Side Request Forgery in mindsdb CVE-2023-49795Medium6.5fixed in 23.11.4.1 | Medium6.5 | 23.11.4.1 |
| Aug 12023 | MindsDB can be made to not verify SSL certificates CVE-2023-38699Critical9.1fixed in 23.7.4.0 | Critical9.1 | 23.7.4.0 |
| Mar 302023 | mindsdb arbitrary file write when extracting a remotely retrieved Tarball CVE-2023-30620High7.5fixed in 23.2.1.0 | High7.5 | 23.2.1.0 |
| Mar 302023 | Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location CVE-2022-23522Medium8.5fixed in 22.11.4.3 | Medium8.5 | 22.11.4.3 |
About MindsDB
The AI data platform: models and agents over your databases.
Packages watched: mindsdb (PyPI).