-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mindsdb | pip | >= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe use of eval() in SharePoint integration functions handling user-provided data. The GitHub commit shows replacements of eval() with ast.literal_eval() in these specific functions across sharepoint_api.py. HiddenLayer's advisory explicitly identifies these functions as injection points where attacker-controlled input (from INSERT queries) is passed to eval(), enabling code execution. The high confidence comes from direct evidence in commit diffs and CVE-specific descriptions linking these functions to the vulnerability.