CRITICAL9.0

PYSEC-2026-1628

MindsDB Cross-site Scripting vulnerability

Details

A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mindsdb

Introduced in: 0

No fixed version published yet for mindsdb (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-45856[ADVISORY]
https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb[WEB]
https://pypi.org/project/mindsdb[PACKAGE]
https://github.com/advisories/GHSA-32fj-r8qw-r8w8[ADVISORY]