Suggestions search

All statuses

Filter by:

With package: python313Packages.mindsdb-evaluator

Found 2 matching suggestions

View:

Compact

Detailed

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-7712

6.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 3 weeks, 1 day ago by @LeSuisse Activity log

Created suggestion 3 weeks, 1 day ago
@LeSuisse dismissed (not in Nixpkgs) 3 weeks, 1 day ago

MindsDB Pickle pickle.loads deserialization

A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

VDB-360888 | MindsDB Pickle pickle.loads deserialization vdb-entrytechnical-description
VDB-360888 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
Submit #806827 | https://github.com/mindsdb/mindsdb <=26.01 Remote Code Execution third-party-advisory
https://github.com/nn0nkey/JD-Security-SHENYI-Team/blob/main/MindsDB_Pickle_RCE… exploit

Affected products

MindsDB

==26.01

Matching in nixpkgs

pkgs.python312Packages.mindsdb-evaluator

Model evaluation for Machine Learning pipelines

nixos-25.11 0.0.20
- nixos-25.11-small 0.0.20
- nixpkgs-25.11-darwin 0.0.20

pkgs.python313Packages.mindsdb-evaluator

Model evaluation for Machine Learning pipelines

nixos-unstable 0.0.21
- nixpkgs-unstable 0.0.21
- nixos-unstable-small 0.0.21
nixos-25.11 0.0.20
- nixos-25.11-small 0.0.20
- nixpkgs-25.11-darwin 0.0.20

pkgs.python314Packages.mindsdb-evaluator

Model evaluation for Machine Learning pipelines

nixos-unstable 0.0.21
- nixpkgs-unstable 0.0.21
- nixos-unstable-small 0.0.21

Package maintainers

@mbalatsko Maksym Balatsko <mbalatsko@gmail.com>

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-7711

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 3 weeks, 1 day ago by @LeSuisse Activity log

Created suggestion 3 weeks, 1 day ago
@LeSuisse dismissed (not in Nixpkgs) 3 weeks, 1 day ago

MindsDB Engine proc_wrapper.py exec unrestricted upload

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.