The vulnerability in MindsDB Minds Platform version 26.1.0 and earlier allows an attacker who can reach the API to execute arbitrary operating system commands. By creating a prompt that is sent to the unprotected POST /api/v1/responses/ endpoint, the agent’s scratchpad tool calls exec() on Python code supplied by the attacker without sandboxing. This leads to full OS command execution with the privileges of the desktop application user, enabling attackers to read SSH keys, credentials and environment secrets. The weakness is identified as CWE‑94: Improper Control of Generation of Code ('Code Injection').

Any installation of MindsDB Minds Platform before or equal to version 26.1.0 is affected. The platform is sold by MindsDB under the product name Minds Platform. Attackers do not need authentication or any additional privileges to exploit the flaw.

The CVSS score is 10, indicating the highest level of severity. EPSS data is unavailable, so current exploitation probability cannot be quantified, but the vulnerability is unauthenticated and reachable from the network, making exploitation trivial for an attacker who can send HTTP requests. The vulnerability is not currently listed in the CISA KEV catalog, however the lack of authentication and the high impact make it a priority target. Attackers can first set an arbitrary LLM API key with the unauthenticated PUT /api/v1/settings/ endpoint, then submit a crafted prompt to trigger the scratchpad exec() and run arbitrary commands.