-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe eval() usage in SharePoint integration handlers. The commit diff shows eval() was replaced with ast.literal_eval in these specific functions across sharepoint_api.py. These functions process user-controlled input from INSERT queries (CVE-2024-45851's attack vector) and directly passed untrusted data to eval(), enabling arbitrary code execution. The high confidence comes from: 1) Direct correlation between patched functions and vulnerability description 2) Explicit eval() usage shown in pre-patch code 3) Microsoft SharePoint context matching the advisory's scope 4) Multiple CWE-95 references confirming eval injection pattern.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mindsdb | pip | >= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
PythonPythonOngoing coverage of React2Shell