GitHub Advisoryadvisory · PyPI

GHSA-m6m4-34cj-4hh7 MindSQL is vulnerable to Code Injection through its ask_db function

LOW Published 2026-03-21 Modified 2026-03-23 Official page ↗
Aliases
CVE-2026-4506
Ecosystem
PyPI
Packages
mindsql
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-74
Reviewed
2026-03-23

Affected packages

• PyPI mindsql: <= 0.2.1 (no fix yet)

Description

A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask_db of the file mindsql/core/mindsql_core.py. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-4506 A vulnerability was found in Mindinventory MindSQL up to 0.2.1. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References