PyPI/mindsdb CVE-2023-30620: high 7.5, EPSS 0.99%

mindsdb arbitrary file write when extracting a remotely retrieved Tarball

Action: Upgrade mindsdb to 23.2.1.0 or later.

pip install mindsdb==23.2.1.0

Affected

Fixed versions

Sources

• osv: GHSA-2g5w-29q9-w6hx
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx
• https://nvd.nist.gov/vuln/detail/CVE-2023-30620
• https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039
• https://github.com/mindsdb/mindsdb
• https://github.com/mindsdb/mindsdb/blob/afedd37c16e579b6dc075b0814e42d0505ccdc07/mindsdb/api/http/namespaces/file.py#L26..L134
• https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-27.yaml

CVE-2023-30620 · published 2023-03-30T21:42:48Z · modified 2026-09-10T03:49:52.273912063Z · JSON