---
id: CVE-2024-45847
aliases:
  - GHSA-crmg-rp64-5cm3
  - PYSEC-2026-1629
title: MindsDB Eval Injection vulnerability
summary: MindsDB Eval Injection vulnerability
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: mindsdb
product: mindsdb
ecosystem: pip
affected:
  - 'mindsdb >= 23.11.4.2, < 24.7.4.1'
patched:
  - mindsdb 24.7.4.1
published: '2024-09-12'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-crmg-rp64-5cm3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-45847'
  - url: >-
      https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80
  - url: 'https://github.com/mindsdb/mindsdb'
  - url: 'https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb'
tags:
  - osv
  - pip
epss: 0.00851
epssPercentile: 0.56703
ingestedAt: '2026-07-08T18:25:48.566Z'
---

## Overview

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.

## Affected packages

- `mindsdb >= 23.11.4.2, < 24.7.4.1`

## Remediation

Upgrade to a patched release:

- `mindsdb 24.7.4.1`