CVE-2024-45852

Advisory

Affected versions of the MindsDB platform contain a critical security vulnerability. The platform's use of unsafe deserialization allows maliciously uploaded models to execute arbitrary code on the server when interacted with. This vulnerability stems from the use of the Python pickle module to deserialize untrusted data. Attackers can exploit this flaw to run unauthorized code, potentially compromising the entire system. If updates are unavailable, implement strict input validation, use safer serialization methods like JSON, and consider sandboxing untrusted code execution.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-7vhj-pfwv-hx3w
• https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/proc_wrapper.py#L54-L55
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45852