Description
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mindsdb | mindsdb | 23.10.3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mindsdb | >= 23.10.3.0, <= 24.9.2.1 | — | GHSA-7vhh-gfjc-x8rm |
| PyPI | mindsdb | >= 23.10.3.0 | — | PYSEC-2024-84 |