mindsdb (PyPI)
Advisories
46
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 26.0.0rc1 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "mindsdb>=26.0.0rc1"poetry
poetry add "mindsdb>=26.0.0rc1"uv
uv add "mindsdb>=26.0.0rc1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9f6m-65v9-x9g2 MindsDB has an Improper Access Control Issue |
High EPSS 0.28% |
<= 26.0.1 | No fix yet |
| GHSA-9f6m-65v9-x9g2 MindsDB has an Improper Access Control Issue |
High EPSS 0.28% |
<= 26.0.1 | No fix yet |
| GHSA-4894-xqv6-vrfq MindsDB: Path Traversal in /api/files Leading to Remote Code Execution |
High EPSS 10.99% |
< 25.9.1.1 | 25.9.1.1 |
| GHSA-4894-xqv6-vrfq MindsDB: Path Traversal in /api/files Leading to Remote Code Execution |
High EPSS 10.99% |
< 25.9.1.1 | 25.9.1.1 |
| GHSA-6xw9-2p64-7622 MindsDB affected by a SSRF vulnerability |
High EPSS 0.27% |
< 26.0.0rc1 | 26.0.0rc1 |
| GHSA-6xw9-2p64-7622 MindsDB affected by a SSRF vulnerability |
High EPSS 0.27% |
<= 25.14.1 | No fix yet |
| GHSA-qqhf-pm3j-96g7 MindsDB has improper sanitation of filepath that leads to information disclosure and DOS |
Critical EPSS 20.26% |
< 25.11.1 | 25.11.1 |
| GHSA-qqhf-pm3j-96g7 MindsDB has improper sanitation of filepath that leads to information disclosure and DOS |
Critical EPSS 20.26% |
< 25.11.1 | 25.11.1 |
| GHSA-32fj-r8qw-r8w8 MindsDB Cross-site Scripting vulnerability |
Medium EPSS 0.51% |
<= 24.9.2.1 | No fix yet |
| GHSA-32fj-r8qw-r8w8 MindsDB Cross-site Scripting vulnerability |
Medium EPSS 0.51% |
<= 24.9.2.1 | No fix yet |
| GHSA-crmg-rp64-5cm3 MindsDB Eval Injection vulnerability |
High EPSS 0.85% |
>= 23.11.4.2, < 24.7.4.1 | 24.7.4.1 |
| GHSA-crmg-rp64-5cm3 MindsDB Eval Injection vulnerability |
High EPSS 0.85% |
>= 23.11.4.2, < 24.7.4.1 | 24.7.4.1 |
| GHSA-c85f-pcx6-2ghm MindsDB Eval Injection vulnerability |
High EPSS 0.87% |
>= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-7vhj-pfwv-hx3w MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.69% |
>= 23.3.2.0 | No fix yet |
| GHSA-7vhh-gfjc-x8rm MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.51% |
>= 23.10.3.0, <= 24.9.2.1 | No fix yet |
| GHSA-7vhh-gfjc-x8rm MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.51% |
>= 23.10.3.0 | No fix yet |
| GHSA-9gq6-6936-885w MindsDB Eval Injection vulnerability |
High EPSS 0.85% |
>= 23.12.4.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-9gq6-6936-885w MindsDB Eval Injection vulnerability |
High EPSS 0.85% |
>= 23.12.4.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-c85f-pcx6-2ghm MindsDB Eval Injection vulnerability |
High EPSS 0.87% |
>= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-fr9q-rgwq-g5r5 MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.51% |
>= 23.10.2.0, <= 24.9.2.1 | No fix yet |
| GHSA-fr9q-rgwq-g5r5 MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.51% |
>= 23.10.2.0 | No fix yet |
| GHSA-q9r8-89xr-4xv4 MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.51% |
>= 23.10.2.0, <= 24.9.2.1 | No fix yet |
| GHSA-q9r8-89xr-4xv4 MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.51% |
>= 23.10.2.0 | No fix yet |
| GHSA-v6g6-3cm3-vf6c MindsDB Eval Injection vulnerability |
High EPSS 0.87% |
>= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-v6g6-3cm3-vf6c MindsDB Eval Injection vulnerability |
High EPSS 0.87% |
>= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-wcjw-3v6p-4v3r MindsDB Eval Injection vulnerability |
High EPSS 2.15% |
>= 23.10.3.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-wcjw-3v6p-4v3r MindsDB Eval Injection vulnerability |
High EPSS 2.15% |
>= 23.10.3.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-wf9g-c67g-h4ch MindsDB Eval Injection vulnerability |
High EPSS 0.87% |
>= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-wf9g-c67g-h4ch MindsDB Eval Injection vulnerability |
High EPSS 0.87% |
>= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
| GHSA-7vhj-pfwv-hx3w MindsDB Deserialization of Untrusted Data vulnerability |
High EPSS 0.69% |
>= 23.3.2.0, <= 24.9.2.1 | No fix yet |
| GHSA-4jcv-vp96-94xr MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding |
Critical EPSS 4.94% |
< 23.12.4.2 | 23.12.4.2 |
| GHSA-4jcv-vp96-94xr MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding |
Critical EPSS 4.94% |
< 23.12.4.2 | 23.12.4.2 |
| GHSA-93c5-rj2p-w52x Cross-site Scripting (XSS) in mindsdb/mindsdb |
Medium EPSS 0.37% |
<= 23.6.3.1 | No fix yet |
| GHSA-93c5-rj2p-w52x Cross-site Scripting (XSS) in mindsdb/mindsdb |
Medium EPSS 0.37% |
<= 23.6.3.1 | No fix yet |
| GHSA-j8w6-2r9h-cxhj GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182 |
Critical EPSS 0.98% |
< 23.11.4.1 | 23.11.4.1 |
| GHSA-j8w6-2r9h-cxhj GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182 |
Critical EPSS 0.98% |
< 23.11.4.1 | 23.11.4.1 |
| GHSA-crhp-7c74-cg4c Improper Input Validation in mindsdb |
Medium EPSS 0.49% |
all versions | No fix yet |
| GHSA-crhp-7c74-cg4c Improper Input Validation in mindsdb |
Medium EPSS 0.49% |
< 23.11.4.1 | 23.11.4.1 |
| GHSA-34mr-6q8x-g9r6 Server-Side Request Forgery in mindsdb |
Medium EPSS 0.42% |
< 23.11.4.1 | 23.11.4.1 |
| GHSA-34mr-6q8x-g9r6 Server-Side Request Forgery in mindsdb |
Medium EPSS 0.42% |
< 23.11.4.1 | 23.11.4.1 |
| GHSA-8hx6-qv6f-xgcw MindsDB can be made to not verify SSL certificates |
Critical EPSS 0.30% |
< 23.7.4.0 | 23.7.4.0 |
| GHSA-8hx6-qv6f-xgcw MindsDB can be made to not verify SSL certificates |
Critical EPSS 0.30% |
< 23.7.4.0 | 23.7.4.0 |
| GHSA-2g5w-29q9-w6hx mindsdb arbitrary file write when extracting a remotely retrieved Tarball |
High EPSS 0.99% |
< 23.2.1.0 | 23.2.1.0 |
| GHSA-2g5w-29q9-w6hx mindsdb arbitrary file write when extracting a remotely retrieved Tarball |
High EPSS 0.99% |
< 23.2.1.0 | 23.2.1.0 |
| GHSA-7x45-phmr-9wqp Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location |
High EPSS 0.88% |
< 22.11.4.3 | 22.11.4.3 |
| GHSA-7x45-phmr-9wqp Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location |
High EPSS 0.88% |
< 22.11.4.3 | 22.11.4.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor