High severity · published Sep 12, 2024
CVE-2024-45847
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Mindsdb · Mindsdb
23.11.4.2 before 24.7.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45847
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45847
Exploit
https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
More from Mindsdb
9.1
CVE-2025-68472
MindsDB is a platform for building artificial intelligence from enterprise data
9.1
CVE-2024-24759
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
9.1
CVE-2023-50731
MindsDB is a SQL Server for artificial intelligence
8.8
CVE-2026-92207
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
8.8
CVE-2026-27483
MindsDB is a platform for building artificial intelligence from enterprise data