{"data":{"id":"19618777-72c8-4e52-8fab-47354114c62d","title":"CVE-2023-30620: mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction…","summary":"CVE-2023-30620 affects mindsdb, a machine learning platform for building AI solutions, in affected versions. The platform calls `tarfile.extractall()` on a remotely retrieved tarball without safe handling, so extracted files can be written to an unintended location. An attacker can use this to overwrite any local file the server process can access, though the source states there is no risk of file exposure.","solution":"Fixed in release `23.2.1.0`. Users are advised to upgrade. No known workarounds.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-30620","publishedAt":"2023-04-21T21:15:08.053Z","cveId":"CVE-2023-30620","cweIds":["CWE-22"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mindsdb@< 23.2.1.0 (fixed: 23.2.1.0)"],"affectedPackageNames":["mindsdb"],"affectedPackageRefs":["pypi:mindsdb"],"affectedVendors":[],"affectedVendorsRaw":["MindsDB"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mindsdb path traversal via unsafe tar extraction","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00992,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":["GHSA-2g5w-29q9-w6hx"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:02.064Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-02-02T08:38:33.301Z","daysToFix":-78,"fixCheckedAt":"2026-10-29T21:47:05.055Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mindsdb","fixedVersion":"23.2.1.0","matchedVersion":"23.2.1.0","fixReleasedAt":"2023-02-02T08:38:33.301Z","daysToFix":-78,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:04.902Z"}]}}