{"schema_version":1,"title":"mindsdb (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 23 vulnerabilities in mindsdb (PyPI): 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-7711, was published on 13 July 2026.","url":"https://junglewise.ai/threats/technologies/mindsdb","json_url":"https://junglewise.ai/threats/technologies/mindsdb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/mindsdb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":23,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":3,"last_365_days":6},"latest":[{"cve":"CVE-2026-7711","cvss":3.1,"epss":0.0047,"slug":"cve-2026-7711-mindsdb-has-an-improper-access-control-issue","title":"PYSEC-2026-2648 - MindsDB has an Improper Access Control Issue","severity":"low","exploited":false,"published_at":"2026-07-13T15:02:56.32581+00:00","url":"https://junglewise.ai/threats/cve-2026-7711-mindsdb-has-an-improper-access-control-issue"},{"cve":"CVE-2024-45856","cvss":3.1,"epss":0.0051,"slug":"cve-2024-45856-mindsdb-cross-site-scripting-in-web-ui","title":"PYSEC-2026-1628 - MindsDB Cross-site Scripting vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:40.694033+00:00","url":"https://junglewise.ai/threats/cve-2024-45856-mindsdb-cross-site-scripting-in-web-ui"},{"cve":"CVE-2024-45847","cvss":3.1,"epss":0.0085,"slug":"cve-2024-45847-mindsdb-eval-injection-vulnerability","title":"PYSEC-2026-1629 - MindsDB Eval Injection vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:40.612166+00:00","url":"https://junglewise.ai/threats/cve-2024-45847-mindsdb-eval-injection-vulnerability"},{"cve":"CVE-2026-27483","cvss":8.8,"epss":0.0882,"slug":"cve-2026-27483-mindsdb-path-traversal-in-api-files-leading-to-rce","title":"MindsDB path traversal in /api/files leading to RCE","severity":"high","exploited":false,"published_at":"2026-02-24T20:07:58+00:00","url":"https://junglewise.ai/threats/cve-2026-27483-mindsdb-path-traversal-in-api-files-leading-to-rce"},{"cve":"CVE-2026-2531","cvss":6.3,"epss":0.0024,"slug":"cve-2026-2531-mindsdb-ssrf-via-url-validation-bypass-in-file-upload","title":"MindsDB SSRF via URL validation bypass in File Upload","severity":"medium","exploited":false,"published_at":"2026-02-16T06:31:29+00:00","url":"https://junglewise.ai/threats/cve-2026-2531-mindsdb-ssrf-via-url-validation-bypass-in-file-upload"},{"cve":"CVE-2025-68472","cvss":8.1,"epss":0.2026,"slug":"cve-2025-68472-mindsdb-path-traversal-in-file-upload-api","title":"MindsDB path traversal in file upload API","severity":"high","exploited":false,"published_at":"2026-01-12T16:10:55+00:00","url":"https://junglewise.ai/threats/cve-2025-68472-mindsdb-path-traversal-in-file-upload-api"},{"cve":"CVE-2024-45854","cvss":3.1,"epss":0.0051,"slug":"cve-2024-45854-mindsdb-deserialization-of-untrusted-data-vulnerability","title":"PYSEC-2024-84 - Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhous","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45854-mindsdb-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2024-45848","cvss":3.1,"epss":0.0085,"slug":"cve-2024-45848-mindsdb-eval-injection-vulnerability","title":"PYSEC-2024-78 - An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45848-mindsdb-eval-injection-vulnerability"},{"cve":"CVE-2024-45851","cvss":3.1,"epss":0.0087,"slug":"cve-2024-45851-mindsdb-eval-injection-vulnerability","title":"PYSEC-2024-81 - An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45851-mindsdb-eval-injection-vulnerability"},{"cve":"CVE-2024-45849","cvss":3.1,"epss":0.0087,"slug":"cve-2024-45849-mindsdb-eval-injection-vulnerability","title":"PYSEC-2024-79 - An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45849-mindsdb-eval-injection-vulnerability"},{"cve":"CVE-2024-45853","cvss":3.1,"epss":0.0051,"slug":"cve-2024-45853-mindsdb-deserialization-of-untrusted-data-vulnerability","title":"PYSEC-2024-83 - Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhous","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45853-mindsdb-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2024-45855","cvss":3.1,"epss":0.0051,"slug":"cve-2024-45855-mindsdb-deserialization-of-untrusted-data-vulnerability","title":"PYSEC-2024-85 - Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhous","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45855-mindsdb-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2024-45846","cvss":3.1,"epss":0.0215,"slug":"cve-2024-45846-mindsdb-eval-injection-vulnerability","title":"PYSEC-2024-77 - An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45846-mindsdb-eval-injection-vulnerability"},{"cve":"CVE-2024-45850","cvss":3.1,"epss":0.0087,"slug":"cve-2024-45850-mindsdb-eval-injection-vulnerability","title":"PYSEC-2024-80 - An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45850-mindsdb-eval-injection-vulnerability"},{"cve":"CVE-2024-45852","cvss":3.1,"epss":0.0069,"slug":"cve-2024-45852-mindsdb-deserialization-of-untrusted-data-vulnerability","title":"PYSEC-2024-82 - Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45852-mindsdb-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2024-24759","cvss":3.1,"epss":0.0494,"slug":"cve-2024-24759-mindsdb-vulnerable-to-bypass-of-ssrf-protection-with-dns","title":"PYSEC-2024-74 - MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the s","severity":"low","exploited":false,"published_at":"2024-09-05T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-24759-mindsdb-vulnerable-to-bypass-of-ssrf-protection-with-dns"},{"cve":"CVE-2024-3575","cvss":5.8,"epss":0.0037,"slug":"cve-2024-3575-mindsdb-stored-xss-via-csv-file-upload","title":"MindsDB stored XSS via CSV file upload","severity":"medium","exploited":false,"published_at":"2024-04-16T00:30:34+00:00","url":"https://junglewise.ai/threats/cve-2024-3575-mindsdb-stored-xss-via-csv-file-upload"},{"cve":"CVE-2023-50731","cvss":3.1,"epss":0.0098,"slug":"cve-2023-50731-github-security-lab-ghsl-vulnerability-report-arbitary-write-ghsl","title":"PYSEC-2023-279 - MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/fi","severity":"low","exploited":false,"published_at":"2023-12-22T21:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-50731-github-security-lab-ghsl-vulnerability-report-arbitary-write-ghsl"},{"cve":"CVE-2023-49796","cvss":3.1,"epss":0.0049,"slug":"cve-2023-49796-improper-input-validation-in-mindsdb","title":"PYSEC-2023-278 - MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in","severity":"low","exploited":false,"published_at":"2023-12-11T21:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-49796-improper-input-validation-in-mindsdb"},{"cve":"CVE-2023-49795","cvss":3.1,"epss":0.0042,"slug":"cve-2023-49795-mindsdb-server-side-request-forgery-in-file-upload","title":"PYSEC-2023-277 - MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnera","severity":"low","exploited":false,"published_at":"2023-12-11T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-49795-mindsdb-server-side-request-forgery-in-file-upload"},{"cve":"CVE-2023-38699","cvss":3.1,"epss":0.003,"slug":"cve-2023-38699-mindsdb-can-be-made-to-not-verify-ssl-certificates","title":"PYSEC-2023-140 - MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests","severity":"low","exploited":false,"published_at":"2023-08-04T18:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-38699-mindsdb-can-be-made-to-not-verify-ssl-certificates"},{"cve":"CVE-2023-30620","cvss":3.1,"epss":0.0099,"slug":"cve-2023-30620-mindsdb-arbitrary-file-write-via-path-traversal-in-tarball","title":"PYSEC-2023-27 - mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed u","severity":"low","exploited":false,"published_at":"2023-04-21T21:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-30620-mindsdb-arbitrary-file-write-via-path-traversal-in-tarball"},{"cve":"CVE-2022-23522","cvss":3.1,"epss":0.0088,"slug":"cve-2022-23522-arbitrary-file-write-in-mindsdb-when-extracting-tarballs","title":"PYSEC-2023-26 - MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack_archive()` from a remotely","severity":"low","exploited":false,"published_at":"2023-03-30T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2022-23522-arbitrary-file-write-in-mindsdb-when-extracting-tarballs"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"picklescan (PyPI)","slug":"picklescan","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/picklescan"},{"name":"openbabel (PyPI)","slug":"openbabel","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/openbabel"},{"name":"apache-superset (PyPI)","slug":"apache-superset","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/apache-superset"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"weblate (PyPI)","slug":"weblate","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/weblate"},{"name":"mcp-atlassian (PyPI)","slug":"mcp-atlassian","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/mcp-atlassian"},{"name":"crawl4ai (PyPI)","slug":"crawl4ai","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/crawl4ai"},{"name":"moin (PyPI)","slug":"moin","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/moin"}],"technology":{"hub":true,"name":"mindsdb (PyPI)","slug":"mindsdb","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://mindsdb.com/","repo_url":"https://github.com/mindsdb/mindsdb","description":"An open-source platform for building and deploying machine learning models using SQL and automated workflows.","url":"https://junglewise.ai/threats/technologies/mindsdb"},"most_severe":[{"cve":"CVE-2026-27483","cvss":8.8,"epss":0.0882,"slug":"cve-2026-27483-mindsdb-path-traversal-in-api-files-leading-to-rce","title":"MindsDB path traversal in /api/files leading to RCE","severity":"high","exploited":false,"published_at":"2026-02-24T20:07:58+00:00","url":"https://junglewise.ai/threats/cve-2026-27483-mindsdb-path-traversal-in-api-files-leading-to-rce"},{"cve":"CVE-2025-68472","cvss":8.1,"epss":0.2026,"slug":"cve-2025-68472-mindsdb-path-traversal-in-file-upload-api","title":"MindsDB path traversal in file upload API","severity":"high","exploited":false,"published_at":"2026-01-12T16:10:55+00:00","url":"https://junglewise.ai/threats/cve-2025-68472-mindsdb-path-traversal-in-file-upload-api"},{"cve":"CVE-2026-2531","cvss":6.3,"epss":0.0024,"slug":"cve-2026-2531-mindsdb-ssrf-via-url-validation-bypass-in-file-upload","title":"MindsDB SSRF via URL validation bypass in File Upload","severity":"medium","exploited":false,"published_at":"2026-02-16T06:31:29+00:00","url":"https://junglewise.ai/threats/cve-2026-2531-mindsdb-ssrf-via-url-validation-bypass-in-file-upload"},{"cve":"CVE-2024-3575","cvss":5.8,"epss":0.0037,"slug":"cve-2024-3575-mindsdb-stored-xss-via-csv-file-upload","title":"MindsDB stored XSS via CSV file upload","severity":"medium","exploited":false,"published_at":"2024-04-16T00:30:34+00:00","url":"https://junglewise.ai/threats/cve-2024-3575-mindsdb-stored-xss-via-csv-file-upload"},{"cve":"CVE-2024-24759","cvss":3.1,"epss":0.0494,"slug":"cve-2024-24759-mindsdb-vulnerable-to-bypass-of-ssrf-protection-with-dns","title":"PYSEC-2024-74 - MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the s","severity":"low","exploited":false,"published_at":"2024-09-05T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-24759-mindsdb-vulnerable-to-bypass-of-ssrf-protection-with-dns"},{"cve":"CVE-2024-45846","cvss":3.1,"epss":0.0215,"slug":"cve-2024-45846-mindsdb-eval-injection-vulnerability","title":"PYSEC-2024-77 - An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45846-mindsdb-eval-injection-vulnerability"},{"cve":"CVE-2023-30620","cvss":3.1,"epss":0.0099,"slug":"cve-2023-30620-mindsdb-arbitrary-file-write-via-path-traversal-in-tarball","title":"PYSEC-2023-27 - mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed u","severity":"low","exploited":false,"published_at":"2023-04-21T21:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-30620-mindsdb-arbitrary-file-write-via-path-traversal-in-tarball"},{"cve":"CVE-2023-50731","cvss":3.1,"epss":0.0098,"slug":"cve-2023-50731-github-security-lab-ghsl-vulnerability-report-arbitary-write-ghsl","title":"PYSEC-2023-279 - MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/fi","severity":"low","exploited":false,"published_at":"2023-12-22T21:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-50731-github-security-lab-ghsl-vulnerability-report-arbitary-write-ghsl"},{"cve":"CVE-2022-23522","cvss":3.1,"epss":0.0088,"slug":"cve-2022-23522-arbitrary-file-write-in-mindsdb-when-extracting-tarballs","title":"PYSEC-2023-26 - MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack_archive()` from a remotely","severity":"low","exploited":false,"published_at":"2023-03-30T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2022-23522-arbitrary-file-write-in-mindsdb-when-extracting-tarballs"},{"cve":"CVE-2024-45849","cvss":3.1,"epss":0.0087,"slug":"cve-2024-45849-mindsdb-eval-injection-vulnerability","title":"PYSEC-2024-79 - An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint","severity":"low","exploited":false,"published_at":"2024-09-12T13:15:00+00:00","url":"https://junglewise.ai/threats/cve-2024-45849-mindsdb-eval-injection-vulnerability"}],"generated_at":"2026-09-26T13:07:00.120236+00:00"}