CVE-2024-45851: MindsDB Eval Injection vulnerability
8.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.81272%
CWE
Published
9/12/2024
Updated
9/16/2024
KEV Status
No
Technology
Python
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mindsdb | pip | >= 23.10.5.0, < 24.7.4.1 | 24.7.4.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from unsafe eval() usage in SharePoint integration handlers. The commit diff shows eval() was replaced with ast.literal_eval in these specific functions across sharepoint_api.py. These functions process user-controlled input from INSERT queries (CVE-2024-45851's attack vector) and directly passed untrusted data to eval(), enabling arbitrary code execution. The high confidence comes from: 1) Direct correlation between patched functions and vulnerability description 2) Explicit eval() usage shown in pre-patch code 3) Microsoft SharePoint context matching the advisory's scope 4) Multiple CWE-95 references confirming eval injection pattern.