Threats tagged 'ghsa-3jvx-hx5j-cccj'

MindsDB Minds Platform versions up to 26.1.0 contain a critical unauthenticated remote code execution vulnerability. Attackers can exploit the unprotected POST /api/v1/responses/ endpoint to execute arbitrary OS commands by submitting crafted prompts that reach an unsandboxed Python exec() call. This allows full OS command execution as the user running the application, potentially exposing SSH keys, stored credentials, and environment secrets. The vulnerability is fixed in version 26.1.1.