{"action":"Upgrade mindsdb to 23.11.4.1 or later.","affected":[{"fixed":"23.11.4.1","introduced":"0"}],"component":"mindsdb","cve_ids":["CVE-2023-50731"],"ecosystem":"PyPI","epss":0.00983,"exploited":false,"fixed_versions":["23.11.4.1"],"ghsa_id":"GHSA-j8w6-2r9h-cxhj","id":"tcs_01M5KGK98WQHE3H53DG5BQ8P7G","modified_at":"2024-11-21T14:57:10.219827Z","published_at":"2023-12-22T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-279","https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/","https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj","https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125","https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2023-279","url":"https://osv.dev/vulnerability/PYSEC-2023-279"}],"summary":"MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, whi"}