Priority HIGH 82
MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to th…
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01588 · Published 2026-08-14 · No fix listed CWE-94
Priority HIGH 79
MindsDB is a platform for building artificial intelligence from enterprise data.
CVSS 3.1CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.04936 · Published 2024-09-05 · Fixed in 23.12.4.2 CWE-918
Priority HIGH 77
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.lis…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00646 · Published 2026-09-05 · No fix listed CWE-918
Priority HIGH 73
MindsDB is a platform for building artificial intelligence from enterprise data.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.10988 · Published 2026-02-24 · Fixed in 25.9.1.1 CWE-22
Priority HIGH 73
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00864 · Published 2024-09-12 · Fixed in 24.7.4.1 CWE-95
Priority HIGH 73
An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00844 · Published 2024-09-12 · Fixed in 24.7.4.1 CWE-95
Priority HIGH 73
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00851 · Published 2024-09-12 · Fixed in 24.7.4.1 CWE-95
Priority HIGH 73
An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02131 · Published 2024-09-12 · Fixed in 24.7.4.1 CWE-95
Priority HIGH 72
MindsDB is a platform for building artificial intelligence from enterprise data.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.20261 · Published 2026-01-12 · Fixed in 25.11.1 CWE-22
Priority HIGH 72
mindsdb is a Machine Learning platform to help developers build AI solutions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00992 · Published 2023-04-21 · Fixed in 23.2.1.0 CWE-22
Priority HIGH 71
MindsDB is an open source machine learning platform.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00883 · Published 2023-03-30 · Fixed in 22.11.4.3 CWE-22
Priority MEDIUM 60
Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00368 · Published 2024-04-16 · No fix listed CWE-79
Priority MEDIUM 57
A security vulnerability has been detected in MindsDB up to 25.14.1.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00263 · Published 2026-02-16 · No fix listed CWE-918
Priority MEDIUM 47
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00296 · Published 2023-08-04 · Fixed in 23.7.4.0 CWE-311
Priority MEDIUM 42
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00864 · Published 2024-09-12 · Fixed in 24.7.4.1 CWE-95
Priority MEDIUM 42
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00864 · Published 2024-09-12 · Fixed in 24.7.4.1 CWE-95
Priority MEDIUM 41
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00699 · Published 2026-10-21 · No fix listed CWE-94
Priority MEDIUM 41
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing…
CVSS 3.1CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.00506 · Published 2024-09-12 · No fix listed CWE-79
Priority MEDIUM 41
Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0068 · Published 2024-09-12 · No fix listed CWE-502
Priority MEDIUM 41
MindsDB is a SQL Server for artificial intelligence.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00983 · Published 2023-12-22 · Fixed in 23.11.4.1 CWE-918
Priority LOW 35
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00506 · Published 2024-09-12 · No fix listed CWE-502
Priority LOW 35
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on i…
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00506 · Published 2024-09-12 · No fix listed CWE-502
Priority LOW 35
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00506 · Published 2024-09-12 · No fix listed CWE-502
Priority LOW 29
MindsDB connects artificial intelligence models to real time data.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00422 · Published 2023-12-11 · Fixed in 23.11.4.1 CWE-918
Priority LOW 25
MindsDB connects artificial intelligence models to real time data.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00492 · Published 2023-12-11 · Fixed in 23.11.4.1 CWE-20