Eval Injection Affecting mindsdb package, versions [23.10.5.0,24.7.4.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MINDSDB-7945497
- published 13 Sep 2024
- disclosed 12 Sep 2024
- credit Unknown
Introduced: 12 Sep 2024
New CVE-2024-45850 Open this link in a new tabHow to fix?
Upgrade MindsDB to version 24.7.4.1 or higher.
Overview
MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library
Affected versions of this package are vulnerable to Eval Injection due to unprotected eval function inside the create_a_site_column function of the mindsdb/integrations/handlers/sharepoint_handler/sharepoint_api.py file. An attacker can execute arbitrary code on the server through the INSERT query mechanism used for site column creation in the SharePoint engine.