Description
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mindsdb | mindsdb | 23.10.2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mindsdb | >= 23.10.2.0, <= 24.9.2.1 | — | GHSA-q9r8-89xr-4xv4 |
| PyPI | mindsdb | >= 23.10.2.0 | — | PYSEC-2024-83 |