PyPI/mindsdb CVE-2023-50731: critical 9.1, EPSS 0.98%
MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, whi
Action: Upgrade mindsdb to 23.11.4.1 or later.
pip install mindsdb==23.11.4.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 23.11.4.1 | - |
Fixed versions
| 23.11.4.1 |
Sources
- osv: PYSEC-2023-279
- https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj
- https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125
- https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138
CVE-2023-50731 · published · modified · JSON