~ / search / GHSA-9gq6-6936-885w

GHSA-9gq6-6936-885w

MindsDB Eval Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-45848

Packages

EcosystemPackageAffectedFixed in
PyPI mindsdb >= 23.12.4.0, < 24.7.4.1 24.7.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.

References

External links from the advisory. They lead to third-party sites.