~ / search / GHSA-jg95-r9xh-xw9c

GHSA-jg95-r9xh-xw9c

Mage AI incorrectly gives privileges to users with deleted accounts

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-45187

Packages

EcosystemPackageAffectedFixed in
PyPI mage-ai <= 0.9.73 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server.

References

External links from the advisory. They lead to third-party sites.