EUVD-2026-13832
GHSA-m6m4-34cj-4hh7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask_db of the file mindsql/core/mindsql_core.py. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A code injection vulnerability exists in Mindinventory MindSQL up to version 0.2.1 that allows remote code execution through manipulation of the ask_db function in mindsql/core/mindsql_core.py. An authenticated attacker can exploit this vulnerability to execute arbitrary code on the affected system. A public proof-of-concept exploit is available, and the vendor has not responded to early disclosure attempts, increasing the likelihood of active exploitation.
Technical ContextAI
MindSQL is a Python-based library designed to facilitate natural language database queries through AI-driven SQL generation. The vulnerability resides in the ask_db function, which processes user input to generate and execute SQL queries. The root cause is classified under CWE-94 (Improper Control of Generation of Code), indicating that the application fails to properly sanitize or validate user-supplied input before passing it to code execution mechanisms. The affected CPE is cpe:2.3:a:mindinventory:mindsql:*:*:*:*:*:*:*:*, indicating all versions up to 0.2.1 are vulnerable. The code injection occurs at the interface between natural language input processing and SQL/code generation, where insufficient input validation allows attackers to inject arbitrary Python or SQL code that executes with the privileges of the MindSQL process.
RemediationAI
Immediately upgrade Mindinventory MindSQL to a patched version beyond 0.2.1 if available; however, given vendor non-responsiveness, users should verify patch availability through the official GitHub repository or contact Mindinventory directly for a security update timeline. If upgrading is not immediately possible, implement the following mitigations: restrict network access to MindSQL instances to trusted IP ranges only, disable or restrict the ask_db function if not actively required, run MindSQL in an isolated container or virtual machine with minimal privileges, implement input validation and sanitization at the application layer before passing data to ask_db (though this is not a substitute for a vendor patch), and monitor execution logs for suspicious ask_db invocations. Additionally, authenticate all requests with strong credentials since the vulnerability requires PR:L (low privilege level), and consider implementing Web Application Firewall (WAF) rules to detect and block code injection patterns targeting the ask_db endpoint.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today