This vulnerability affects MindsDB up to version 26.01 and stems from the use of the pickle.loads function in the Pickle Handler component, which can be manipulated to perform unsafe deserialization remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, and no privileges or user interaction required. The vendor has not issued any remediation or official fix, and no patch links are available. Exploit details have been publicly disclosed, but there are no known exploits observed in the wild yet.

Successful exploitation could allow a remote attacker to manipulate deserialization in MindsDB, potentially leading to unauthorized code execution or other impacts related to unsafe deserialization. The CVSS score and vector indicate moderate impact with low complexity for an attacker to exploit remotely without privileges or user interaction. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released and the vendor has not responded, users should exercise caution when processing untrusted data with the affected pickle.loads function. Consider applying temporary mitigations such as disabling or restricting the use of pickle deserialization if feasible until an official fix is available.