~ / search / GHSA-wcjw-3v6p-4v3r

GHSA-wcjw-3v6p-4v3r

MindsDB Eval Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-45846

Packages

EcosystemPackageAffectedFixed in
PyPI mindsdb >= 23.10.3.0, < 24.7.4.1 24.7.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.

References

External links from the advisory. They lead to third-party sites.