Which versions of Mindsql are affected by EUVD-2026-13832?

Organizations using Mindinventory MindSQL should be aware of moderate risk from CVE-2026-4506, a code injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for EUVD-2026-13832?

Yes, a public proof-of-concept exploit is available for EUVD-2026-13832. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-13832?

Within 30 days: Identify affected systems running Mindinventory MindSQL and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Mindsql EUVD-2026-13832

Q: What is the CVSS score of EUVD-2026-13832?

EUVD-2026-13832 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4506 LOW

Code Injection (CWE-94)

2026-03-20 VulDB

GHSA-m6m4-34cj-4hh7

RCE Code Injection Mindsql

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:32 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 22:16 euvd

EUVD-2026-13832

Analysis Generated

Mar 20, 2026 - 22:16 vuln.today

CVE Published

Mar 20, 2026 - 22:02 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask_db of the file mindsql/core/mindsql_core.py. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A code injection vulnerability exists in Mindinventory MindSQL up to version 0.2.1 that allows remote code execution through manipulation of the ask_db function in mindsql/core/mindsql_core.py. An authenticated attacker can exploit this vulnerability to execute arbitrary code on the affected system. A public proof-of-concept exploit is available, and the vendor has not responded to early disclosure attempts, increasing the likelihood of active exploitation.

Technical ContextAI

MindSQL is a Python-based library designed to facilitate natural language database queries through AI-driven SQL generation. The vulnerability resides in the ask_db function, which processes user input to generate and execute SQL queries. The root cause is classified under CWE-94 (Improper Control of Generation of Code), indicating that the application fails to properly sanitize or validate user-supplied input before passing it to code execution mechanisms. The affected CPE is cpe:2.3:a:mindinventory:mindsql:*:*:*:*:*:*:*:*, indicating all versions up to 0.2.1 are vulnerable. The code injection occurs at the interface between natural language input processing and SQL/code generation, where insufficient input validation allows attackers to inject arbitrary Python or SQL code that executes with the privileges of the MindSQL process.

RemediationAI

Immediately upgrade Mindinventory MindSQL to a patched version beyond 0.2.1 if available; however, given vendor non-responsiveness, users should verify patch availability through the official GitHub repository or contact Mindinventory directly for a security update timeline. If upgrading is not immediately possible, implement the following mitigations: restrict network access to MindSQL instances to trusted IP ranges only, disable or restrict the ask_db function if not actively required, run MindSQL in an isolated container or virtual machine with minimal privileges, implement input validation and sanitization at the application layer before passing data to ask_db (though this is not a substitute for a vendor patch), and monitor execution logs for suspicious ask_db invocations. Additionally, authenticate all requests with strong credentials since the vulnerability requires PR:L (low privilege level), and consider implementing Web Application Firewall (WAF) rules to detect and block code injection patterns targeting the ask_db endpoint.