Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/mindsdb@1.6.6
Typepypi
Namespace
Namemindsdb
Version1.6.6
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version26.1.0rc1
Latest_non_vulnerable_version26.1.0rc1
Affected_by_vulnerabilities
0
url VCID-34ug-vncd-j7ha
vulnerability_id VCID-34ug-vncd-j7ha
summary Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-3575
reference_id
reference_type
scores
0
value 0.00188
scoring_system epss
scoring_elements 0.40478
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-3575
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://huntr.com/bounties/5f720b48-ddeb-4f2a-830f-a3dd15d5daa2
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
2
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-10T16:19:42Z/
url https://huntr.com/bounties/5f720b48-ddeb-4f2a-830f-a3dd15d5daa2
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-3575
reference_id CVE-2024-3575
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-3575
4
reference_url https://github.com/advisories/GHSA-93c5-rj2p-w52x
reference_id GHSA-93c5-rj2p-w52x
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-93c5-rj2p-w52x
fixed_packages
0
url pkg:pypi/mindsdb@23.6.4.0
purl pkg:pypi/mindsdb@23.6.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5k2e-1txt-9uch
1
vulnerability VCID-9rmd-qne4-17cm
2
vulnerability VCID-jzag-uvvs-3fca
3
vulnerability VCID-krac-rtac-2qe5
4
vulnerability VCID-pcv6-h5w9-ybe2
5
vulnerability VCID-qtua-yjhn-nqav
6
vulnerability VCID-qv2m-udp6-6fb8
7
vulnerability VCID-stp6-86fa-cubn
8
vulnerability VCID-tbn5-7918-tqg2
9
vulnerability VCID-uab9-6bgh-efct
10
vulnerability VCID-vuny-bz3z-kfg4
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@23.6.4.0
aliases CVE-2024-3575, GHSA-93c5-rj2p-w52x, PYSEC-2024-288
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-34ug-vncd-j7ha
1
url VCID-9rmd-qne4-17cm
vulnerability_id VCID-9rmd-qne4-17cm
summary MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-49796
reference_id
reference_type
scores
0
value 0.00868
scoring_system epss
scoring_elements 0.75558
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-49796
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125
3
reference_url https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe
4
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-278.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-278.yaml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-49796
reference_id CVE-2023-49796
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-49796
7
reference_url https://github.com/advisories/GHSA-crhp-7c74-cg4c
reference_id GHSA-crhp-7c74-cg4c
reference_type
scores
url https://github.com/advisories/GHSA-crhp-7c74-cg4c
fixed_packages
0
url pkg:pypi/mindsdb@23.11.4.1
purl pkg:pypi/mindsdb@23.11.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1gz1-9n27-p3gf
1
vulnerability VCID-5k2e-1txt-9uch
2
vulnerability VCID-ba2s-8e42-7ucs
3
vulnerability VCID-c9zz-2wmt-t3hj
4
vulnerability VCID-cgk6-21yc-r3ad
5
vulnerability VCID-d1sm-yyqm-fug8
6
vulnerability VCID-jzag-uvvs-3fca
7
vulnerability VCID-k6m1-mehq-pbez
8
vulnerability VCID-krac-rtac-2qe5
9
vulnerability VCID-kttw-x13y-b3fj
10
vulnerability VCID-qtua-yjhn-nqav
11
vulnerability VCID-stp6-86fa-cubn
12
vulnerability VCID-tbn5-7918-tqg2
13
vulnerability VCID-uab9-6bgh-efct
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@23.11.4.1
aliases CVE-2023-49796, GHSA-crhp-7c74-cg4c, PYSEC-2023-278
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9rmd-qne4-17cm
2
url VCID-d26j-5dz2-vkgf
vulnerability_id VCID-d26j-5dz2-vkgf
summary MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack_archive()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. This vulnerability is sometimes called a **TarSlip** or a **ZipSlip variant**. Unpacking files using the high-level function `shutil.unpack_archive()` from a potentially malicious tarball without validating that the destination file path remained within the intended destination directory may cause files to be overwritten outside the destination directory. An attacker could craft a malicious tarball with a filename path, such as `../../../../../../../../etc/passwd`, and then serve the archive remotely using a personal bucket `s3`, thus, retrieve the tarball through **mindsdb** and overwrite the system files of the hosting server. This issue has been addressed in version 22.11.4.3. Users are advised to upgrade. Users unable to upgrade should avoid ingesting archives from untrusted sources.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-23522
reference_id
reference_type
scores
0
value 0.00403
scoring_system epss
scoring_elements 0.61269
published_at 2026-06-05T12:55:00Z
1
value 0.00403
scoring_system epss
scoring_elements 0.6122
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-23522
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 8.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py
reference_id
reference_type
scores
0
value 8.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py
3
reference_url https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py#L128..L129
reference_id
reference_type
scores
0
value 8.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/blob/69c76e727b8067f32b06ab83bb835a8c416c4f21/mindsdb/interfaces/storage/fs.py#L128..L129
4
reference_url https://github.com/mindsdb/mindsdb/releases/tag/v22.11.4.3
reference_id
reference_type
scores
0
value 8.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/releases/tag/v22.11.4.3
5
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-7x45-phmr-9wqp
reference_id
reference_type
scores
0
value 8.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T14:56:07Z/
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-7x45-phmr-9wqp
6
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-26.yaml
reference_id
reference_type
scores
0
value 8.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-26.yaml
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-23522
reference_id CVE-2022-23522
reference_type
scores
0
value 8.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-23522
8
reference_url https://github.com/advisories/GHSA-7x45-phmr-9wqp
reference_id GHSA-7x45-phmr-9wqp
reference_type
scores
url https://github.com/advisories/GHSA-7x45-phmr-9wqp
fixed_packages
0
url pkg:pypi/mindsdb@22.11.4.3
purl pkg:pypi/mindsdb@22.11.4.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34ug-vncd-j7ha
1
vulnerability VCID-9rmd-qne4-17cm
2
vulnerability VCID-jzag-uvvs-3fca
3
vulnerability VCID-krac-rtac-2qe5
4
vulnerability VCID-pcv6-h5w9-ybe2
5
vulnerability VCID-qtua-yjhn-nqav
6
vulnerability VCID-qv2m-udp6-6fb8
7
vulnerability VCID-stp6-86fa-cubn
8
vulnerability VCID-tbn5-7918-tqg2
9
vulnerability VCID-uab9-6bgh-efct
10
vulnerability VCID-vuny-bz3z-kfg4
11
vulnerability VCID-xwar-wwkh-r7gc
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@22.11.4.3
aliases CVE-2022-23522, GHSA-7x45-phmr-9wqp, PYSEC-2023-26
risk_score 3.9
exploitability 0.5
weighted_severity 7.7
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-d26j-5dz2-vkgf
3
url VCID-jzag-uvvs-3fca
vulnerability_id VCID-jzag-uvvs-3fca
summary MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-24759
reference_id
reference_type
scores
0
value 0.82793
scoring_system epss
scoring_elements 0.99262
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-24759
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 9.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
1
value 7.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
1
value 9.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
2
value 7.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L
3
value HIGH
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-05T17:45:02Z/
url https://github.com/mindsdb/mindsdb/commit/5f7496481bd3db1d06a2d2e62c0dce960a1fe12b
3
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
1
value 9.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
2
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
3
value 7.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L
4
value HIGH
scoring_system generic_textual
scoring_elements
5
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-05T17:45:02Z/
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4jcv-vp96-94xr
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-24759
reference_id CVE-2024-24759
reference_type
scores
0
value 9.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
1
value 7.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:L
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-24759
5
reference_url https://github.com/advisories/GHSA-4jcv-vp96-94xr
reference_id GHSA-4jcv-vp96-94xr
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4jcv-vp96-94xr
fixed_packages
0
url pkg:pypi/mindsdb@23.12.4.2
purl pkg:pypi/mindsdb@23.12.4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1gz1-9n27-p3gf
1
vulnerability VCID-5k2e-1txt-9uch
2
vulnerability VCID-ba2s-8e42-7ucs
3
vulnerability VCID-c9zz-2wmt-t3hj
4
vulnerability VCID-cgk6-21yc-r3ad
5
vulnerability VCID-d1sm-yyqm-fug8
6
vulnerability VCID-fjec-rvym-t3f1
7
vulnerability VCID-k6m1-mehq-pbez
8
vulnerability VCID-krac-rtac-2qe5
9
vulnerability VCID-kttw-x13y-b3fj
10
vulnerability VCID-nktr-gvas-mqcm
11
vulnerability VCID-qtua-yjhn-nqav
12
vulnerability VCID-stp6-86fa-cubn
13
vulnerability VCID-tbn5-7918-tqg2
14
vulnerability VCID-uab9-6bgh-efct
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@23.12.4.2
aliases CVE-2024-24759, GHSA-4jcv-vp96-94xr, PYSEC-2024-74
risk_score 4.2
exploitability 0.5
weighted_severity 8.4
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jzag-uvvs-3fca
4
url VCID-krac-rtac-2qe5
vulnerability_id VCID-krac-rtac-2qe5
summary 
MindsDB has an Improper Access Control Issue
A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-7711
reference_id
reference_type
scores
0
value 0.00054
scoring_system epss
scoring_elements 0.17355
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-7711
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/nn0nkey/JD-Security-SHENYI-Team/blob/main/MindsDB_BYOM_RCE.md
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
1
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
3
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
4
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value MODERATE
scoring_system generic_textual
scoring_elements
7
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T13:19:59Z/
url https://github.com/nn0nkey/JD-Security-SHENYI-Team/blob/main/MindsDB_BYOM_RCE.md
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-7711
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-7711
4
reference_url https://vuldb.com/submit/806822
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
1
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
3
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
4
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value MODERATE
scoring_system generic_textual
scoring_elements
7
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T13:19:59Z/
url https://vuldb.com/submit/806822
5
reference_url https://vuldb.com/vuln/360887
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
1
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
3
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
4
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value MODERATE
scoring_system generic_textual
scoring_elements
7
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T13:19:59Z/
url https://vuldb.com/vuln/360887
6
reference_url https://vuldb.com/vuln/360887/cti
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
1
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
3
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
4
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value MODERATE
scoring_system generic_textual
scoring_elements
7
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-04T13:19:59Z/
url https://vuldb.com/vuln/360887/cti
7
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
8
reference_url https://github.com/advisories/GHSA-9f6m-65v9-x9g2
reference_id GHSA-9f6m-65v9-x9g2
reference_type
scores
url https://github.com/advisories/GHSA-9f6m-65v9-x9g2
fixed_packages
0
url pkg:pypi/mindsdb@26.1.0rc1
purl pkg:pypi/mindsdb@26.1.0rc1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@26.1.0rc1
aliases CVE-2026-7711, GHSA-9f6m-65v9-x9g2
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-krac-rtac-2qe5
5
url VCID-pcv6-h5w9-ybe2
vulnerability_id VCID-pcv6-h5w9-ybe2
summary MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-38699
reference_id
reference_type
scores
0
value 0.00125
scoring_system epss
scoring_elements 0.31258
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-38699
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-03T18:11:04Z/
url https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b
3
reference_url https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-03T18:11:04Z/
url https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0
4
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-03T18:11:04Z/
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-140.yaml
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-140.yaml
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38699
reference_id CVE-2023-38699
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-38699
fixed_packages
0
url pkg:pypi/mindsdb@23.7.4.0
purl pkg:pypi/mindsdb@23.7.4.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5k2e-1txt-9uch
1
vulnerability VCID-9rmd-qne4-17cm
2
vulnerability VCID-jzag-uvvs-3fca
3
vulnerability VCID-krac-rtac-2qe5
4
vulnerability VCID-qtua-yjhn-nqav
5
vulnerability VCID-qv2m-udp6-6fb8
6
vulnerability VCID-stp6-86fa-cubn
7
vulnerability VCID-tbn5-7918-tqg2
8
vulnerability VCID-uab9-6bgh-efct
9
vulnerability VCID-vuny-bz3z-kfg4
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@23.7.4.0
aliases CVE-2023-38699, GHSA-8hx6-qv6f-xgcw, PYSEC-2023-140
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pcv6-h5w9-ybe2
6
url VCID-qtua-yjhn-nqav
vulnerability_id VCID-qtua-yjhn-nqav
summary 
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
There is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-27483
reference_id
reference_type
scores
0
value 0.23286
scoring_system epss
scoring_elements 0.96054
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-27483
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-27T18:19:02Z/
url https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef
3
reference_url https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-27T18:19:02Z/
url https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1
4
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52547.py
reference_id CVE-2026-27483
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52547.py
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-27483
reference_id CVE-2026-27483
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-27483
6
reference_url https://github.com/advisories/GHSA-4894-xqv6-vrfq
reference_id GHSA-4894-xqv6-vrfq
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4894-xqv6-vrfq
7
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq
reference_id GHSA-4894-xqv6-vrfq
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-27T18:19:02Z/
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq
fixed_packages
0
url pkg:pypi/mindsdb@25.9.1.1
purl pkg:pypi/mindsdb@25.9.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-krac-rtac-2qe5
1
vulnerability VCID-stp6-86fa-cubn
2
vulnerability VCID-uab9-6bgh-efct
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@25.9.1.1
aliases CVE-2026-27483, GHSA-4894-xqv6-vrfq
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qtua-yjhn-nqav
7
url VCID-qv2m-udp6-6fb8
vulnerability_id VCID-qv2m-udp6-6fb8
summary MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-50731
reference_id
reference_type
scores
0
value 0.00219
scoring_system epss
scoring_elements 0.44572
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-50731
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 8.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 8.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125
3
reference_url https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 8.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138
4
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 8.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj
5
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-279.yaml
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 8.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-279.yaml
6
reference_url https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 8.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb
7
reference_url https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
url https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-50731
reference_id CVE-2023-50731
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 8.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-50731
9
reference_url https://github.com/advisories/GHSA-j8w6-2r9h-cxhj
reference_id GHSA-j8w6-2r9h-cxhj
reference_type
scores
url https://github.com/advisories/GHSA-j8w6-2r9h-cxhj
fixed_packages
0
url pkg:pypi/mindsdb@23.11.4.1
purl pkg:pypi/mindsdb@23.11.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1gz1-9n27-p3gf
1
vulnerability VCID-5k2e-1txt-9uch
2
vulnerability VCID-ba2s-8e42-7ucs
3
vulnerability VCID-c9zz-2wmt-t3hj
4
vulnerability VCID-cgk6-21yc-r3ad
5
vulnerability VCID-d1sm-yyqm-fug8
6
vulnerability VCID-jzag-uvvs-3fca
7
vulnerability VCID-k6m1-mehq-pbez
8
vulnerability VCID-krac-rtac-2qe5
9
vulnerability VCID-kttw-x13y-b3fj
10
vulnerability VCID-qtua-yjhn-nqav
11
vulnerability VCID-stp6-86fa-cubn
12
vulnerability VCID-tbn5-7918-tqg2
13
vulnerability VCID-uab9-6bgh-efct
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@23.11.4.1
aliases CVE-2023-50731, GHSA-j8w6-2r9h-cxhj, GMS-2023-6179, PYSEC-2023-279
risk_score 4.1
exploitability 0.5
weighted_severity 8.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qv2m-udp6-6fb8
8
url VCID-stp6-86fa-cubn
vulnerability_id VCID-stp6-86fa-cubn
summary A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 74d6f0fd4b630218519a700fbee1c05c7fd4b1ed. It is best practice to apply a patch to resolve this issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-2531
reference_id
reference_type
scores
0
value 0.00078
scoring_system epss
scoring_elements 0.23378
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-2531
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
4
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-17T17:09:50Z/
url https://github.com/mindsdb/mindsdb/
3
reference_url https://github.com/mindsdb/mindsdb/issues/12163
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7
value LOW
scoring_system generic_textual
scoring_elements
8
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-17T17:09:50Z/
url https://github.com/mindsdb/mindsdb/issues/12163
4
reference_url https://github.com/mindsdb/mindsdb/pull/12213
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
4
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7
value LOW
scoring_system generic_textual
scoring_elements
8
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-17T17:09:50Z/
url https://github.com/mindsdb/mindsdb/pull/12213
5
reference_url https://github.com/themavik/mindsdb/commit/74d6f0fd4b630218519a700fbee1c05c7fd4b1ed
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
4
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7
value LOW
scoring_system generic_textual
scoring_elements
8
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-17T17:09:50Z/
url https://github.com/themavik/mindsdb/commit/74d6f0fd4b630218519a700fbee1c05c7fd4b1ed
6
reference_url https://vuldb.com/?ctiid.346119
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
4
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7
value LOW
scoring_system generic_textual
scoring_elements
8
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-17T17:09:50Z/
url https://vuldb.com/?ctiid.346119
7
reference_url https://vuldb.com/?id.346119
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7
value LOW
scoring_system generic_textual
scoring_elements
8
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-17T17:09:50Z/
url https://vuldb.com/?id.346119
8
reference_url https://vuldb.com/?submit.748219
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
3
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7
value LOW
scoring_system generic_textual
scoring_elements
8
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-17T17:09:50Z/
url https://vuldb.com/?submit.748219
9
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-2531
reference_id CVE-2026-2531
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-2531
11
reference_url https://github.com/advisories/GHSA-6xw9-2p64-7622
reference_id GHSA-6xw9-2p64-7622
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6xw9-2p64-7622
fixed_packages
0
url pkg:pypi/mindsdb@26.0.0rc1
purl pkg:pypi/mindsdb@26.0.0rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-krac-rtac-2qe5
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@26.0.0rc1
aliases CVE-2026-2531, GHSA-6xw9-2p64-7622, PYSEC-2026-91
risk_score 3.3
exploitability 0.5
weighted_severity 6.6
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-stp6-86fa-cubn
9
url VCID-tbn5-7918-tqg2
vulnerability_id VCID-tbn5-7918-tqg2
summary 
MindsDB Cross-site Scripting vulnerability
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-45856
reference_id
reference_type
scores
0
value 0.00158
scoring_system epss
scoring_elements 0.36445
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-45856
1
reference_url https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb
reference_id
reference_type
scores
0
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value 6.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-45856
reference_id CVE-2024-45856
reference_type
scores
0
value 9.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
1
value 6.4
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-45856
3
reference_url https://github.com/advisories/GHSA-32fj-r8qw-r8w8
reference_id GHSA-32fj-r8qw-r8w8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-32fj-r8qw-r8w8
fixed_packages
aliases CVE-2024-45856, GHSA-32fj-r8qw-r8w8
risk_score 4.0
exploitability 0.5
weighted_severity 8.1
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tbn5-7918-tqg2
10
url VCID-uab9-6bgh-efct
vulnerability_id VCID-uab9-6bgh-efct
summary MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-68472
reference_id
reference_type
scores
0
value 0.00353
scoring_system epss
scoring_elements 0.57961
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-68472
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/releases/tag/v25.11.1
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/releases/tag/v25.11.1
3
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-qqhf-pm3j-96g7
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
2
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
3
value HIGH
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-12T18:36:34Z/
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-qqhf-pm3j-96g7
4
reference_url https://www.bluerock.io/post/cve-2025-68472-mindsdb-file-upload-path-traversal
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.bluerock.io/post/cve-2025-68472-mindsdb-file-upload-path-traversal
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-68472
reference_id CVE-2025-68472
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-68472
6
reference_url https://github.com/advisories/GHSA-qqhf-pm3j-96g7
reference_id GHSA-qqhf-pm3j-96g7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qqhf-pm3j-96g7
fixed_packages
0
url pkg:pypi/mindsdb@25.11.1
purl pkg:pypi/mindsdb@25.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-krac-rtac-2qe5
1
vulnerability VCID-stp6-86fa-cubn
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@25.11.1
aliases CVE-2025-68472, GHSA-qqhf-pm3j-96g7, PYSEC-2026-90
risk_score 4.1
exploitability 0.5
weighted_severity 8.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uab9-6bgh-efct
11
url VCID-vuny-bz3z-kfg4
vulnerability_id VCID-vuny-bz3z-kfg4
summary MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnerability in `file.py`. This can lead to limited information disclosure. Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-49795
reference_id
reference_type
scores
0
value 0.00353
scoring_system epss
scoring_elements 0.58021
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-49795
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe
3
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-34mr-6q8x-g9r6
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-34mr-6q8x-g9r6
4
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-277.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-277.yaml
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-49795
reference_id CVE-2023-49795
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-49795
6
reference_url https://github.com/advisories/GHSA-34mr-6q8x-g9r6
reference_id GHSA-34mr-6q8x-g9r6
reference_type
scores
url https://github.com/advisories/GHSA-34mr-6q8x-g9r6
fixed_packages
0
url pkg:pypi/mindsdb@23.11.4.1
purl pkg:pypi/mindsdb@23.11.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1gz1-9n27-p3gf
1
vulnerability VCID-5k2e-1txt-9uch
2
vulnerability VCID-ba2s-8e42-7ucs
3
vulnerability VCID-c9zz-2wmt-t3hj
4
vulnerability VCID-cgk6-21yc-r3ad
5
vulnerability VCID-d1sm-yyqm-fug8
6
vulnerability VCID-jzag-uvvs-3fca
7
vulnerability VCID-k6m1-mehq-pbez
8
vulnerability VCID-krac-rtac-2qe5
9
vulnerability VCID-kttw-x13y-b3fj
10
vulnerability VCID-qtua-yjhn-nqav
11
vulnerability VCID-stp6-86fa-cubn
12
vulnerability VCID-tbn5-7918-tqg2
13
vulnerability VCID-uab9-6bgh-efct
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@23.11.4.1
aliases CVE-2023-49795, GHSA-34mr-6q8x-g9r6, PYSEC-2023-277
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vuny-bz3z-kfg4
12
url VCID-xwar-wwkh-r7gc
vulnerability_id VCID-xwar-wwkh-r7gc
summary mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30620
reference_id
reference_type
scores
0
value 0.00649
scoring_system epss
scoring_elements 0.71239
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30620
1
reference_url https://github.com/mindsdb/mindsdb
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb
2
reference_url https://github.com/mindsdb/mindsdb/blob/afedd37c16e579b6dc075b0814e42d0505ccdc07/mindsdb/api/http/namespaces/file.py#L26..L134
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/mindsdb/mindsdb/blob/afedd37c16e579b6dc075b0814e42d0505ccdc07/mindsdb/api/http/namespaces/file.py#L26..L134
3
reference_url https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T19:57:14Z/
url https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039
4
reference_url https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T19:57:14Z/
url https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0
5
reference_url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-04T19:57:14Z/
url https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx
6
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-27.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-27.yaml
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30620
reference_id CVE-2023-30620
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30620
8
reference_url https://github.com/advisories/GHSA-2g5w-29q9-w6hx
reference_id GHSA-2g5w-29q9-w6hx
reference_type
scores
url https://github.com/advisories/GHSA-2g5w-29q9-w6hx
fixed_packages
0
url pkg:pypi/mindsdb@23.2.1.0
purl pkg:pypi/mindsdb@23.2.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-34ug-vncd-j7ha
1
vulnerability VCID-9rmd-qne4-17cm
2
vulnerability VCID-jzag-uvvs-3fca
3
vulnerability VCID-krac-rtac-2qe5
4
vulnerability VCID-pcv6-h5w9-ybe2
5
vulnerability VCID-qtua-yjhn-nqav
6
vulnerability VCID-qv2m-udp6-6fb8
7
vulnerability VCID-stp6-86fa-cubn
8
vulnerability VCID-tbn5-7918-tqg2
9
vulnerability VCID-uab9-6bgh-efct
10
vulnerability VCID-vuny-bz3z-kfg4
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@23.2.1.0
aliases CVE-2023-30620, GHSA-2g5w-29q9-w6hx, GMS-2023-934, PYSEC-2023-27
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xwar-wwkh-r7gc
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/mindsdb@1.6.6