This vulnerability affects MindsDB up to version 26.01 and arises from the use of the pickle.loads function in the Pickle Handler component, which can be manipulated to perform unsafe deserialization. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, and no user interaction needed. The vendor has not provided any remediation or official fix, and no patch links or advisories are available. The exploit has been publicly disclosed, but there are no known exploits in the wild at this time.

Successful exploitation could allow an attacker to manipulate the deserialization process remotely, potentially leading to unauthorized code execution or other impacts related to unsafe deserialization. The CVSS score indicates a medium impact level. However, the exact impact details beyond deserialization manipulation are not specified in the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by the vendor and no patches are available, users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the vulnerable component and applying network-level controls to limit exposure.