# mindsdb (PyPI) vulnerabilities 23 known vulnerabilities (4 critical, 14 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 26.1.0 (Apr 23, 2026): affected by 4 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 1,854 - Dependents: 1 - Releases: 500+ since 1.5.1 (Sep 20, 2019) - Registry: https://pypi.org/project/mindsdb/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-7711: 1.5.1 to 26.0.1 (26.1.0rc1 is outside it) - CVE-2026-27483: 1.5.1 to 25.9.1.0 (25.9.1.1 is outside it) - CVE-2026-2531: 1.5.1 to 25.14.1 (26.0.0rc1 is outside it) - CVE-2025-68472: 1.5.1 to 25.11.0 (25.11.1 is outside it) - CVE-2024-45856: 1.5.1 to 24.9.2.1 (24.9.3.0 is outside it) - CVE-2024-45855: 23.10.2.0 to 26.1.0 (through the newest release) - CVE-2024-45854: 23.10.3.0 to 26.1.0 (through the newest release) - CVE-2024-45853: 23.10.2.0 to 26.1.0 (through the newest release) - CVE-2024-45852: 23.3.2.0 to 26.1.0 (through the newest release) - CVE-2024-45851: 23.10.5.0 to 24.7.4.0 (24.7.4.1 is outside it) - CVE-2024-45850: 23.10.5.0 to 24.7.4.0 (24.7.4.1 is outside it) - CVE-2024-45849: 23.10.5.0 to 24.7.4.0 (24.7.4.1 is outside it) - CVE-2024-45848: 23.12.4.0 to 24.7.4.0 (24.7.4.1 is outside it) - CVE-2024-45847: 23.11.4.4a6 to 24.7.4.0 (24.7.4.1 is outside it) - CVE-2024-45846: 23.10.3.0 to 24.7.4.0 (24.7.4.1 is outside it) - CVE-2024-24759: 1.5.1 to 23.12.4.1 (23.12.4.2 is outside it) - CVE-2024-3575: 1.5.1 to 23.6.3.1 (23.6.4.0 is outside it) - CVE-2023-50731: 1.5.1 to 23.11.4.0 (23.11.4.1 is outside it) - CVE-2023-49796: 1.5.1 to 23.11.4.0 (23.11.4.1 is outside it) - CVE-2023-49795: 1.5.1 to 23.11.4.0 (23.11.4.1 is outside it) - CVE-2023-38699: 1.5.1 to 23.7.3.1 (23.7.4.0 is outside it) - CVE-2023-30620: 1.5.1 to 23.1.5.0 (23.2.1.0 is outside it) - CVE-2022-23522: 1.5.1 to 22.11.4.2 (22.11.4.3 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (23) ### [CVE-2026-7711](https://cve.now/CVE-2026-7711): MindsDB Engine proc\_wrapper.py exec unrestricted upload - Severity: Medium 6.9 - Published: May 3, 2026 - Affected: through 26.0.1. - Fixed in 26.1.0 (released Apr 23, 2026, 10 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 26.1.0, is not affected. ### [CVE-2026-27483](https://cve.now/CVE-2026-27483): MindsDB has Path Traversal in /api/files Leading to Remote Code Execution - Severity: High 8.8 - Published: Feb 24, 2026 - Affected: fixed in 25.9.1.1. - Fixed in 25.9.1.1 (released Sep 4, 2025, 173 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2026-2531](https://cve.now/CVE-2026-2531): MindsDB File Upload security.py clear\_filename server-side request forgery - Severity: Medium 5.3 - Published: Feb 16, 2026 - Affected: through 25.14.1; fixed in 26.0.0rc1. - Fixed in 26.0.0rc1 (released Feb 17, 2026, 1 day after disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2025-68472](https://cve.now/CVE-2025-68472): MindsDB has improper sanitation of filepath that leads to information disclosure and DOS - Severity: High 8.1 - Published: Jan 12, 2026 - Affected: fixed in 25.11.1. - Fixed in 25.11.1 (released Dec 3, 2025, 40 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-45856](https://cve.now/CVE-2024-45856): A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload… - Severity: Critical 9.0 - Published: Sep 12, 2024 - Affected: through 24.9.2.1. - Fixed in 24.9.3.0 (released Sep 17, 2024, 5 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 26.1.0, is not affected. ### [CVE-2024-45855](https://cve.now/CVE-2024-45855): Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded… - Severity: High 7.1 - Published: Sep 12, 2024 - Affected: from 23.10.2.0, through 24.9.2.1; from 23.10.2.0. - No fix released. The latest release, 26.1.0, is still affected. ### [CVE-2024-45854](https://cve.now/CVE-2024-45854): Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded… - Severity: High 7.1 - Published: Sep 12, 2024 - Affected: from 23.10.3.0, through 24.9.2.1; from 23.10.3.0. - No fix released. The latest release, 26.1.0, is still affected. ### [CVE-2024-45853](https://cve.now/CVE-2024-45853): Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded… - Severity: High 7.1 - Published: Sep 12, 2024 - Affected: from 23.10.2.0, through 24.9.2.1; from 23.10.2.0. - No fix released. The latest release, 26.1.0, is still affected. ### [CVE-2024-45852](https://cve.now/CVE-2024-45852): Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model… - Severity: High 8.8 - Published: Sep 12, 2024 - Affected: from 23.3.2.0; from 23.3.2.0, through 24.9.2.1. - No fix released. The latest release, 26.1.0, is still affected. ### [CVE-2024-45851](https://cve.now/CVE-2024-45851): An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft… - Severity: High 8.8 - Published: Sep 12, 2024 - Affected: from 23.10.5.0, fixed in 24.7.4.1. - Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-45850](https://cve.now/CVE-2024-45850): An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft… - Severity: High 8.8 - Published: Sep 12, 2024 - Affected: from 23.10.5.0, fixed in 24.7.4.1. - Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-45849](https://cve.now/CVE-2024-45849): An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft… - Severity: High 8.8 - Published: Sep 12, 2024 - Affected: from 23.10.5.0, fixed in 24.7.4.1. - Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-45848](https://cve.now/CVE-2024-45848): An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB… - Severity: High 8.8 - Published: Sep 12, 2024 - Affected: from 23.12.4.0, fixed in 24.7.4.1. - Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-45847](https://cve.now/CVE-2024-45847): An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several… - Severity: High 8.8 - Published: Sep 12, 2024 - Affected: from 23.11.4.2, fixed in 24.7.4.1. - Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-45846](https://cve.now/CVE-2024-45846): An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate… - Severity: High 8.8 - Published: Sep 12, 2024 - Affected: from 23.10.3.0, fixed in 24.7.4.1. - Fixed in 24.7.4.1 (released Jul 24, 2024, 50 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-24759](https://cve.now/CVE-2024-24759): MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding - Severity: Critical 9.3 - Published: Sep 5, 2024 - Affected: fixed in 23.12.4.2. - Fixed in 23.12.4.2 (released Jan 5, 2024, 244 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2024-3575](https://cve.now/CVE-2024-3575): Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb - Severity: Medium 5.8 - Published: Apr 16, 2024 - Affected: through 23.6.3.1. - Fixed in 23.6.4.0 (released Jun 20, 2023, 301 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 26.1.0, is not affected. ### [CVE-2023-50731](https://cve.now/CVE-2023-50731): MindsDB has arbitrary file write in file.py - Severity: Critical 9.1 - Published: Dec 22, 2023 - Affected: fixed in 23.11.4.1. - Fixed in 23.11.4.1 (released Dec 7, 2023, 15 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2023-49796](https://cve.now/CVE-2023-49796): MindsDB Arbitrary File Write vulnerability - Severity: Medium 5.3 - Published: Dec 11, 2023 - Affected: fixed in 23.11.4.1. - Fixed in 23.11.4.1 (released Dec 7, 2023, 4 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2023-49795](https://cve.now/CVE-2023-49795): MindsDB Server-Side Request Forgery vulnerability - Severity: Medium 6.5 - Published: Dec 11, 2023 - Affected: fixed in 23.11.4.1. - Fixed in 23.11.4.1 (released Dec 7, 2023, 4 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2023-38699](https://cve.now/CVE-2023-38699): MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issue - Severity: Critical 9.1 - Published: Aug 4, 2023 - Affected: fixed in 23.7.4.0. - Fixed in 23.7.4.0 (released Jul 25, 2023, 10 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2023-30620](https://cve.now/CVE-2023-30620): Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb - Severity: High 7.5 - Published: Apr 21, 2023 - Affected: fixed in 23.2.1.0. - Fixed in 23.2.1.0 (released Feb 2, 2023, 78 days before disclosure). - The latest release, 26.1.0, is not affected. ### [CVE-2022-23522](https://cve.now/CVE-2022-23522): Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdb - Severity: High 8.5 - Published: Mar 30, 2023 - Affected: fixed in 22.11.4.3. - Fixed in 22.11.4.3 (released Dec 9, 2022, 111 days before disclosure). - The latest release, 26.1.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/mindsdb Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.