CVE-2024-45847

Advisory

A critical arbitrary code execution vulnerability affects MindsDB, particularly when using the ChromaDB, SharePoint, Weaviate, or VectorDatabase integrations. The vulnerability stems from the use of the eval() function to parse user-supplied data in 'UPDATE' queries and other input fields. Attackers can exploit this vulnerability by crafting malicious input containing Python code, which the system will execute on the server. This flaw allows unauthorized command execution, potentially compromising the system's integrity and confidentiality. The vulnerability falls under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Users must update to the latest version immediately, which replaces the unsafe eval() function with ast.literal_eval(), effectively mitigating the risk of code injection attacks. This change significantly improves security by limiting evaluation to literal expressions only, preventing the execution of arbitrary Python code.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-9gq6-6936-885w
• https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45847