Live › vulnerability › CVE-2026-92207
Go to dashboardMindsDB's OpenBBtable class passes a user-supplied string to Python execution without validating it. An attacker with a valid account can run arbitrary code as the MindsDB service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mindsdb | pypi | 25.10.1 (later versions unknown) | – |
| mindsdb | pypi | <= 25.10.1 (up to < 26.1.0 probable) | 26.1.0 (unconfirmed) |
pip show mindsdb 25.10.1 and earlier are affected; versions before 26.1.0 are probably affected26.1.0 or later (likely; verify that openbb_tables.py in your install no longer calls eval, and that _resolve_openbb_command exists)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability.
The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.
This page as .md · .json · in your agent: get_signal("CVE-2026-92207")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.