CVE-2024-45846

Advisory

An arbitrary code execution vulnerability affects MindsDB, particularly when using the Weaviate, ChromaDB, SharePoint, and VectorDatabase integrations. The vulnerability stems from the use of the eval() function to parse user-supplied data in 'SELECT WHERE' clauses and other input fields. Attackers can exploit this vulnerability by crafting malicious input containing Python code, which the system will execute on the server. This flaw can lead to unauthorized command execution, potentially compromising the system's integrity and confidentiality. The vulnerability falls under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Users must update to the latest version immediately, which replaces the unsafe eval() function with ast.literal_eval(), effectively mitigating the risk of code injection attacks.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-wcjw-3v6p-4v3r
• https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45846