MindsDB’s OpenBBtable component contains an unchecked string that is passed to the Python interpreter, allowing an authenticated attacker to run arbitrary code in the service account context. The vulnerability falls under code injection and can lead to complete system compromise, data exfiltration, or further lateral movement.

The affected vendor is MindsDB, product MindsDB. Specific affected versions are not listed in the available data.

The CVSS score of 8.8 indicates a high severity flaw. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack requires authenticated access to the MindsDB service; an attacker with valid credentials can supply a malicious string to the OpenBBtable API and trigger remote code execution. In the absence of mitigation steps, the high severity and authentication requirement suggest that this flaw could be leveraged by attackers who have compromised credentials or by victim organizations that expose the service over networks.