Is CVE-2024-45856 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-45856 being exploited in the wild.

How severe is CVE-2024-45856?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

mindsdb (PyPI) ECOSYSTEM:introduced=0,last_affected=24.9.2.1.

Is there a fix for CVE-2024-45856?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-45856 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-45856?

Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45856: PYSEC-2026-1628 - MindsDB Cross-site Scripting vulnerability

CVE-2024-45856 · Severity: low · CVSS 3.1 · Published 2026-07-07

MindsDB is an open-source machine learning platform that provides a web interface for managing ML engines, databases, projects, and datasets. A cross-site scripting (XSS) vulnerability allows attackers with authenticated access to inject arbitrary JavaScript code that executes whenever users enumerate these objects, potentially enabling session hijacking, data theft, or unauthorized actions performed on behalf of the victim.

Technologies: mindsdb (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-45856 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-45856 being exploited in the wild.
How severe is CVE-2024-45856?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: mindsdb (PyPI) ECOSYSTEM:introduced=0,last_affected=24.9.2.1.
Is there a fix for CVE-2024-45856?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-45856 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-45856?: Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability (CWE-79) exists in MindsDB's web UI that allows authenticated users to inject arbitrary JavaScript code into ML Engine, database, project, or dataset names or configurations. The injected payload executes in the browser context of any other user who enumerates these objects. Exploitation requires an authenticated attacker and user interaction (viewing affected objects), but the impact includes high confidentiality, integrity, and availability risks through session token theft, credential harvesting, or malware injection. The vulnerability affects all versions up to at least v24.9.2.1; patch status should be verified against official MindsDB release notes.

Affected products

MindsDB MindsDB up to 24.9.2.1

Identifiers

CVE-2024-45856
GHSA-32fj-r8qw-r8w8
PYSEC-2026-1628

Timeline

2024-09-12: disclosed
2024-09-12: other: Published as GHSA-32fj-r8qw-r8w8, CVE-2024-45856

References

https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.