GitHub Advisoryadvisory · PyPI

GHSA-wcjw-3v6p-4v3r MindsDB Eval Injection vulnerability

HIGH Published 2024-09-12 Modified 2024-09-16 Official page ↗
Aliases
CVE-2024-45846
Ecosystem
PyPI
Packages
mindsdb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94, CWE-95
Reviewed
2024-09-12

Affected packages

• PyPI mindsdb: >= 23.10.3.0, < 24.7.4.1 → fixed in 24.7.4.1

Description

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.

Related

Alias · CVE (1)

  • CVE-2024-45846 An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate… vulnerability

Weakness · CWE (2)

  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References