Description
Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mindsdb | mindsdb | 23.3.2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mindsdb | >= 23.3.2.0, <= 24.9.2.1 | — | GHSA-7vhj-pfwv-hx3w |
| PyPI | mindsdb | >= 23.3.2.0 | — | PYSEC-2024-82 |