Description
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mindsdb | mindsdb | 23.10.2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mindsdb | >= 23.10.2.0, <= 24.9.2.1 | — | GHSA-fr9q-rgwq-g5r5 |
| PyPI | mindsdb | >= 23.10.2.0 | — | PYSEC-2024-85 |