VYPR
← All advisories
High severity8.8NVD Advisory· Published Sep 12, 2024· Updated Jun 17, 2026

CVE-2024-45847

CVE-2024-45847

Description

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mindsdbPyPI
>= 23.11.4.2, < 24.7.4.124.7.4.1

Affected products

3
  • Mindsdb/Mindsdb2 versions
    cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*range: >=23.11.4.2,<24.7.4.1
    • (no CPE)range: 23.11.4.2
  • ghsa-coords
    pkg:pypi/mindsdb
    Range: >= 23.11.4.2, < 24.7.4.1

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.