# CVE-2024-45856: PYSEC-2026-1628 - MindsDB Cross-site Scripting vulnerability

Source: https://junglewise.ai/threats/cve-2024-45856-mindsdb-cross-site-scripting-in-web-ui  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-45856 · Severity: low · CVSS 3.1 · Published 2026-07-07

MindsDB is an open-source machine learning platform that provides a web interface for managing ML engines, databases, projects, and datasets. A cross-site scripting (XSS) vulnerability allows attackers with authenticated access to inject arbitrary JavaScript code that executes whenever users enumerate these objects, potentially enabling session hijacking, data theft, or unauthorized actions performed on behalf of the victim.

Technologies: [mindsdb (PyPI)](https://junglewise.ai/threats/technologies/mindsdb). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-45856 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-45856 being exploited in the wild.

**How severe is CVE-2024-45856?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** mindsdb (PyPI) ECOSYSTEM:introduced=0,last_affected=24.9.2.1.

**Is there a fix for CVE-2024-45856?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-45856 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-45856?** Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability (CWE-79) exists in MindsDB's web UI that allows authenticated users to inject arbitrary JavaScript code into ML Engine, database, project, or dataset names or configurations. The injected payload executes in the browser context of any other user who enumerates these objects. Exploitation requires an authenticated attacker and user interaction (viewing affected objects), but the impact includes high confidentiality, integrity, and availability risks through session token theft, credential harvesting, or malware injection. The vulnerability affects all versions up to at least v24.9.2.1; patch status should be verified against official MindsDB release notes.

## Affected products

- MindsDB MindsDB up to 24.9.2.1

## Identifiers

- CVE-2024-45856
- GHSA-32fj-r8qw-r8w8
- PYSEC-2026-1628

## Timeline

- 2024-09-12: disclosed
- 2024-09-12: other: Published as GHSA-32fj-r8qw-r8w8, CVE-2024-45856

## References

- [https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb](https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb)

## Related threats

- [PYSEC-2026-2648 - MindsDB has an Improper Access Control Issue](https://junglewise.ai/threats/cve-2026-7711-mindsdb-has-an-improper-access-control-issue)
- [PYSEC-2026-1629 - MindsDB Eval Injection vulnerability](https://junglewise.ai/threats/cve-2024-45847-mindsdb-eval-injection-vulnerability)
- [MindsDB path traversal in /api/files leading to RCE](https://junglewise.ai/threats/cve-2026-27483-mindsdb-path-traversal-in-api-files-leading-to-rce)
- [MindsDB SSRF via URL validation bypass in File Upload](https://junglewise.ai/threats/cve-2026-2531-mindsdb-ssrf-via-url-validation-bypass-in-file-upload)
- [MindsDB path traversal in file upload API](https://junglewise.ai/threats/cve-2025-68472-mindsdb-path-traversal-in-file-upload-api)