CVE-2024-45854

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.3.0 and newer

Description: The issue is related to the deserialization of untrusted data in the MindsDB platform. This allows a maliciously uploaded 'inhouse' model to run arbitrary code on the server when a 'describe' query is run on it.

Recommendations: For MindsDB versions 23.10.3.0 and newer, consider disabling the deserialization of untrusted data as a temporary workaround until a patch is available. Restrict access to the 'describe' query functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.