Homepage

mindsdb@1.4.9 vulnerabilities

MindsDB's AI SQL Server enables developers to build AI tools that need access to real-time data to perform their tasks

  • latest version

    24.12.1.0

  • first published

    6 years ago

  • latest version published

    3 hours ago

  • licenses detected

    • MIT
      [0.6.5,2.6.0); [23.11.4.0,24.10.4.1)
  • View mindsdb package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mindsdb package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Cross-site Scripting (XSS) dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) whenever another user enumerates unsanitized items within the UI. An attacker can execute arbitrary JavaScript code by injecting malicious scripts into the input fields.

    How to fix Cross-site Scripting (XSS)?

    There is no fixed version for MindsDB.

    [0,)
    • H
    Server-side Request Forgery (SSRF) dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the is_private_url function. An attacker can manipulate DNS responses to redirect traffic to malicious sites or local IP addresses by exploiting the DNS rebinding technique.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade MindsDB to version 23.12.4.2 or higher.

    [,23.12.4.2)
    • M
    Cross-site Scripting dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Cross-site Scripting due to improper sanitization of user-supplied input. An attacker can inject malicious scripts into web pages viewed by other users.

    Note: This is true for both cloud version and OSS version.

    How to fix Cross-site Scripting?

    Upgrade MindsDB to version 23.10.2.0 or higher.

    [,23.10.2.0)
    • M
    Files or Directories Accessible to External Parties dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties. An attacker can write arbitrary files to the system by exploiting insufficient validation of user-supplied input.

    How to fix Files or Directories Accessible to External Parties?

    Upgrade MindsDB to version 23.11.4.1 or higher.

    [,23.11.4.1)
    • M
    Server-side Request Forgery (SSRF) dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the put method in mindsdb/mindsdb/api/http/namespaces/file.py file. An attacker can disclose sensitive information and potentially interact with internal systems by sending crafted requests.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade MindsDB to version 23.11.4.0 or higher.

    [,23.11.4.0)
    • C
    Improper Certificate Validation dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Improper Certificate Validation due to explicitly disabling SSL certificate verification by using verify=False. SSL certificate checks are disabled, and the application is not verifying the authenticity of the SSL certificate presented by the server.

    How to fix Improper Certificate Validation?

    Upgrade MindsDB to version 23.7.4.0 or higher.

    [,23.7.4.0)
    • H
    Arbitrary File Write via Archive Extraction (Zip Slip) dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to an unsafe extraction which is performed using the shutil.unpack_archive() function from a remotely retrieved tarball. This can lead to the writing of the extracted files to an unintended location.

    How to fix Arbitrary File Write via Archive Extraction (Zip Slip)?

    There is no fixed version for MindsDB.

    [0,)
    • M
    Arbitrary File Write via Archive Extraction (Zip Slip) dsfsdf

    MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library

    Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to an unsafe extraction which is performed using tarfile.extractall() function from a remotely retrieved tarball. This can lead to the writing of the extracted files to an unintended location.

    How to fix Arbitrary File Write via Archive Extraction (Zip Slip)?

    Upgrade MindsDB to version 23.2.1.0 or higher.

    [,23.2.1.0)
    Go back to all versions of this package