CVE-2024-45847: MindsDB Eval Injection Vulnerability Leading to Arbitrary Code Execution
Summary
CVE-2024-45847: MindsDB Eval Injection vulnerability. Affects mindsdb versions >= 23.11.4.2, < 24.7.4.1. Fixed in 24.7.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MindsDB is an open-source platform that simplifies the integration of machine learning into applications by allowing users to create and manage machine learning models directly within databases. It provides various integrations to enhance its functionality, making it a powerful tool for developers. However, certain versions of MindsDB are vulnerable to an Eval Injection vulnerability, which can lead to severe security risks if exploited.
Vulnerability Detail
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform. This vulnerability arises when specific integrations are installed on the server. If an attacker executes a specially crafted 'UPDATE' query containing Python code against a database created with the affected integration engine, the code will be passed to an eval function and executed on the server. This can lead to unauthorized access and control over the server, potentially compromising sensitive data and system integrity.
How To Fix
Latest published version: 26.1.0 as of 22 Oct 2026
pip install --upgrade "mindsdb==26.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
24.7.4.1
This is the first release that contains the fix.
pip install --upgrade "mindsdb==24.7.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the specific integrations that are known to be vulnerable until you can apply the patch. This can help mitigate the risk of exploitation while you prepare for the update.
Conclusion
The MindsDB Eval Injection vulnerability (CVE-2024-45847) poses a significant risk of arbitrary code execution in specific versions of the platform. It is crucial to update to the latest version to mitigate this risk. Utilize available tools like Vulert to monitor and assess your application's vulnerability status.
See every vulnerability recorded for mindsdb →
FAQ
CVE-2024-45847 is a vulnerability in the MindsDB platform that allows for arbitrary code execution through crafted SQL queries.
Versions 23.11.4.2 up to 24.7.4.1 of MindsDB are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider disabling the vulnerable integrations as a temporary workaround to reduce risk.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mindsdb.
