Which versions of Mindsql are affected by CVE-2026-4507?

Organizations using Mindinventory MindSQL should be aware of moderate risk from CVE-2026-4507, a SQL injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4507?

Yes, a public proof-of-concept exploit is available for CVE-2026-4507. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4507?

Within 30 days: Identify affected systems running Mindinventory MindSQL and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Mindsql CVE-2026-4507

Q: What is the CVSS score of CVE-2026-4507?

CVE-2026-4507 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13833 LOW

SQL Injection (CWE-89)

2026-03-20 VulDB

GHSA-w7qc-r6gf-85jh

SQLi Mindsql

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:32 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 22:16 euvd

EUVD-2026-13833

Analysis Generated

Mar 20, 2026 - 22:16 vuln.today

CVE Published

Mar 20, 2026 - 22:02 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was determined in Mindinventory MindSQL up to 0.2.1. The affected element is the function ask_db of the file mindsql/core/mindsql_core.py. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Mindinventory MindSQL versions up to 0.2.1 allows authenticated remote attackers to execute arbitrary SQL commands through the ask_db function. Public exploit code exists for this vulnerability, and the vendor has not provided a patch or responded to disclosure attempts. Attackers with valid credentials can manipulate database queries to access, modify, or delete sensitive data.

Technical ContextAI

MindSQL is a text-to-SQL conversion library developed by Mindinventory that translates natural language queries into SQL statements. The vulnerability resides in the ask_db function, which fails to properly sanitize user-supplied input before incorporating it into SQL queries, violating the principles defined in CWE-89 (SQL Injection). This is a classic input validation flaw where user-controlled data reaches a SQL query constructor without adequate parameterization or escaping. The affected component (cpe:2.3:a:mindinventory:mindsql) processes user input through a language model interface that generates SQL, creating a critical trust boundary where the generated SQL is not validated before execution. The root cause is insufficient input validation at the boundary between user input and database query construction.

RemediationAI

Upgrade MindSQL to a version released after 0.2.1 that contains the SQL injection fix; check the official Mindinventory MindSQL GitHub repository for the latest patched release. If upgrading is not immediately possible, implement the following compensating controls: enforce strict input validation and parameterized queries at the application layer above MindSQL, restrict database user permissions to the minimum required (apply principle of least privilege for the service account), isolate MindSQL instances to trusted network segments only and disable remote access where feasible, implement database query auditing and alerting for suspicious SQL patterns, and consider running MindSQL in a sandboxed environment with restricted database permissions. Monitor https://vuldb.com/?submit.773899 and the vendor's official channels for patch release announcements.