CVE-2024-45846: Code execution flaw in MindsDB Weaviate integration
MindsDB
MindsDB contains a remote code execution vulnerability when the Weaviate integration is installed and crafted queries are evaluated. Affected versions range from 23.10.3.0 up to 24.7.4.1.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 8.8
- EPSS
- 0.02 · top 18% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 12 Sep 2024
- last update
- 12 Sep 2024
- CVE ids
Timeline · 1
Sources · 1
Advisories and databases
- 2024-09-12CVE-2024-45846: An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate…NVD · nvd.nist.gov/vuln/detail/CVE-2024-45846
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Infrastructure vulnerability
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- owasp llm top 10
- LLM03:2025 Supply Chain
- mitre atlas
- no technique for these categories
- dates
- happened 12 Sep 2024 · first reported 12 Sep 2024
- origin
- NVDVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2024-45846: Code execution flaw in MindsDB Weaviate integration https://gcdradar.vercel.app/incidents/cve-2024-45846-code-execution-flaw-in-mindsdb-weaviate-integ · AIR-2024-0255 · closed 2024-09-12 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2024-09-12 - AI role: Attack on AI - Products: MindsDB - CVE ids: CVE-2024-45846 - CVSS: 8.8 ## Summary MindsDB contains a remote code execution vulnerability when the Weaviate integration is installed and crafted queries are evaluated. Affected versions range from 23.10.3.0 up to 24.7.4.1. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2024-09-12: CVE-2024-45846: An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate… (https://nvd.nist.gov/vuln/detail/CVE-2024-45846) ## Sources - 2024-09-12 NVD: CVE-2024-45846: An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate… https://nvd.nist.gov/vuln/detail/CVE-2024-45846 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed8.8MindsDB CVE-2024-45848: Code execution flaw in MindsDB ChromaDB integration
Patch now · Disclosed · since 12 Sep 2024 · CVE-2024-45848
AI - closed6.9LoLLMs CVE-2024-6985: LoLLMs path traversal in open_personality_folder endpoint
Patch now · Disclosed · since 11 Oct 2024 · CVE-2024-6985
AI - closed3.4LoLLMs CVE-2024-6971: LoLLMs Server path traversal vulnerability
Patch now · Disclosed · since 11 Oct 2024 · CVE-2024-6971
AI - closed7.5Gradio CVE-2024-47867: Gradio lacks FRP client integrity checking
Patch now · Disclosed · since 10 Oct 2024 · CVE-2024-47867
AI - closed6.9Gradio CVE-2024-47868: Gradio component post-processing file leaks
Patch now · Disclosed · since 10 Oct 2024 · CVE-2024-47868
AI - closed5.4Gradio CVE-2024-47872: Gradio cross-site scripting via file uploads
Patch now · Disclosed · since 10 Oct 2024 · CVE-2024-47872
AI