We use cookies to improve your experience on our site.
AVID-2026-R1534
Description
Vulnerability CVE-2024-45846
Details
An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.
Reason for inclusion in AVID: The CVE describes an arbitrary code execution vulnerability in the MindsDB platform (with Weaviate integration) that can be exploited via a crafted SQL-like clause to execute Python code on the server. This is an issue within AI-related software used to build/deploy AI models and serve AI workloads, i.e., part of the AI software stack. It affects the runtime/serving components and dependencies used to run general-purpose AI systems, representing a software supply-chain vulnerability in AI systems. It is a vulnerability type (RCE) with clear security impact.
References
Affected or Relevant Artifacts
- Developer: mindsdb
- Deployer: mindsdb
- Artifact Details:
| Type | Name |
|---|---|
| System | mindsdb |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Base Score | 8.8 |
| Base Severity | 🔴 High |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | 🟢 Low |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | 🔴 High |
| Integrity Impact | 🔴 High |
| Availability Impact | 🔴 High |
CWE
| ID | Description |
|---|---|
| CWE-95 | CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2024-09-12
- Version: 0.3.3
- AVID Entry