~ / search / GHSA-93c5-rj2p-w52x

GHSA-93c5-rj2p-w52x

Cross-site Scripting (XSS) in mindsdb/mindsdb

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-3575

Packages

EcosystemPackageAffectedFixed in
PyPI mindsdb <= 23.6.3.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

When a user uploads a csv file that contains an javascript payload a Cross-site Scripting (XSS) is triggered when the file is viewed. This is true for both cloud version and OSS version.

References

External links from the advisory. They lead to third-party sites.