Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

mindsdb

23 known vulnerabilities (4 critical, 14 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
26.1.0 (Apr 23, 2026): affected by 4 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
23 · 4 critical, 14 high, 5 medium
Weekly downloads
1,854
Dependents
1
Releases
500+ since 1.5.1 (Sep 20, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 23 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 23

  • CVE-2026-7711Medium 6.9

    MindsDB Engine proc_wrapper.py exec unrestricted upload

    Affected: through 26.0.1.

    Fixed in 26.1.0 (released Apr 23, 2026, 10 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 26.1.0, is not affected.

  • MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

    Affected: fixed in 25.9.1.1.

    Fixed in 25.9.1.1 (released Sep 4, 2025, 173 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • CVE-2026-2531Medium 5.3

    MindsDB File Upload security.py clear_filename server-side request forgery

    Affected: through 25.14.1; fixed in 26.0.0rc1.

    Fixed in 26.0.0rc1 (released Feb 17, 2026, 1 day after disclosure).

    The latest release, 26.1.0, is not affected.

  • MindsDB has improper sanitation of filepath that leads to information disclosure and DOS

    Affected: fixed in 25.11.1.

    Fixed in 25.11.1 (released Dec 3, 2025, 40 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • CVE-2024-45856Critical 9.0

    A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload…

    Affected: through 24.9.2.1.

    Fixed in 24.9.3.0 (released Sep 17, 2024, 5 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 26.1.0, is not affected.

  • Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded…

    Affected: from 23.10.2.0, through 24.9.2.1; from 23.10.2.0.

    No fix released. The latest release, 26.1.0, is still affected.

  • Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded…

    Affected: from 23.10.3.0, through 24.9.2.1; from 23.10.3.0.

    No fix released. The latest release, 26.1.0, is still affected.

  • Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded…

    Affected: from 23.10.2.0, through 24.9.2.1; from 23.10.2.0.

    No fix released. The latest release, 26.1.0, is still affected.

  • Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model…

    Affected: from 23.3.2.0; from 23.3.2.0, through 24.9.2.1.

    No fix released. The latest release, 26.1.0, is still affected.

  • An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft…

    Affected: from 23.10.5.0, fixed in 24.7.4.1.

    Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft…

    Affected: from 23.10.5.0, fixed in 24.7.4.1.

    Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft…

    Affected: from 23.10.5.0, fixed in 24.7.4.1.

    Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB…

    Affected: from 23.12.4.0, fixed in 24.7.4.1.

    Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several…

    Affected: from 23.11.4.2, fixed in 24.7.4.1.

    Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate…

    Affected: from 23.10.3.0, fixed in 24.7.4.1.

    Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure).

    The latest release, 26.1.0, is not affected.

Show all 23 advisoriesShow fewer advisories
  • CVE-2024-24759Critical 9.3

    MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

    Affected: fixed in 23.12.4.2.

    Fixed in 23.12.4.2 (released Jan 5, 2024, 244 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • CVE-2024-3575Medium 5.8

    Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb

    Affected: through 23.6.3.1.

    Fixed in 23.6.4.0 (released Jun 20, 2023, 301 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 26.1.0, is not affected.

  • CVE-2023-50731Critical 9.1

    MindsDB has arbitrary file write in file.py

    Affected: fixed in 23.11.4.1.

    Fixed in 23.11.4.1 (released Dec 7, 2023, 15 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • CVE-2023-49796Medium 5.3

    MindsDB Arbitrary File Write vulnerability

    Affected: fixed in 23.11.4.1.

    Fixed in 23.11.4.1 (released Dec 7, 2023, 4 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • CVE-2023-49795Medium 6.5

    MindsDB Server-Side Request Forgery vulnerability

    Affected: fixed in 23.11.4.1.

    Fixed in 23.11.4.1 (released Dec 7, 2023, 4 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • CVE-2023-38699Critical 9.1

    MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue

    Affected: fixed in 23.7.4.0.

    Fixed in 23.7.4.0 (released Jul 25, 2023, 10 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb

    Affected: fixed in 23.2.1.0.

    Fixed in 23.2.1.0 (released Feb 2, 2023, 78 days before disclosure).

    The latest release, 26.1.0, is not affected.

  • Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdb

    Affected: fixed in 22.11.4.3.

    Fixed in 22.11.4.3 (released Dec 9, 2022, 111 days before disclosure).

    The latest release, 26.1.0, is not affected.