Description
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mindsdb | mindsdb | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mindsdb | <= 24.9.2.1 | — | GHSA-32fj-r8qw-r8w8 |