CVE-2024-45848

Advisory

A critical arbitrary code execution vulnerability affects MindsDB, particularly when using the ChromaDB, SharePoint, Weaviate, or VectorDatabase integrations. Attackers can exploit this vulnerability by crafting malicious 'INSERT', 'UPDATE', or other queries containing Python code, which the system executes on the server using the unsafe eval() function. This flaw allows unauthorized command execution, potentially compromising the system's integrity and confidentiality. The vulnerability falls under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Users must update to the latest version immediately, which replaces the unsafe eval() function with ast.literal_eval(). This change significantly improves security by limiting evaluation to literal expressions only, preventing the execution of arbitrary Python code and effectively mitigating the risk of code injection attacks.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-9gq6-6936-885w
• https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45848