Threats affecting pkg:pypi/mindsdb

CVE-2026-7712 is a medium severity vulnerability in MindsDB version 26.01 involving unsafe deserialization via the pickle.loads function in the Pickle Handler component. This flaw allows remote attackers to manipulate deserialization processes. The vulnerability has been publicly disclosed with exploit details available, but no official vendor response or patch has been provided as of the publication date.

CVE-2026-7711 is a medium-severity vulnerability in MindsDB version 26.01 affecting the Engine Handler component. It allows remote attackers to perform unrestricted file uploads via the exec function in mindsdb/integrations/handlers/byom_handler/proc_wrapper.py. The vulnerability has a CVSS 4.0 base score of 6.9 and the exploit code is publicly available. The vendor has not responded to the disclosure and no official patch or remediation guidance is currently available.