CVE-2024-45848 - CVE House
Back to Database
Status published High CVE-2024-45848

An arbitrary code execution vulnerability exists in versions 23.12.4.0 up...

Vulnerability Description

An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45848

Credits & Attribution

No credits recorded in the NVD database.

References

More from mindsdb

View All →
CVE-2025-68472
MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
High 8.1
CVE-2024-45856
A cross-site scripting (XSS) vulnerability exists in all versions of...
Critical 9
CVE-2024-45855
Deserialization of untrusted data can occur in versions 23.10.2.0 and...
High 7.1
CVE-2024-45854
Deserialization of untrusted data can occur in versions 23.10.3.0 and...
High 7.1
CVE-2024-45853
Deserialization of untrusted data can occur in versions 23.10.2.0 and...
High 7.1

Affected Vendor

Affected Software

mindsdb
Vulnerable Versions:
23.12.4.0

Timeline

Official Publish: September 12th, 2024
Last Modified: September 12th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-95

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.