CVE-2024-45187

CVE-2024-45187 describes an incorrect privilege assignment in Mage AI: guest users who remain logged in after account deletion are granted high privileges and can remotely execute arbitrary code via the Mage AI terminal server. The incident is caused by deleted accounts still having active privil...

CVE-2024-45189

Mage AI is affected by a path traversal vulnerability in the Git Content request that allows remote users with the Viewer role to leak arbitrary files from the Mage server. The issue is documented across multiple sources (CVE-2024-45189, related advisories) and is characterized by improper input ...

CVE-2023-31143

CVE-2023-31143 affects Mage‑AI where, when using Mage with user authentication enabled, prior to version 0.8.72, unauthenticated users or users without editor permissions could access the terminal. Affected versions are 0.8.34 through 0.8.71; a fix is available in 0.8.72. Red Hat and OSV entries ...

CVE-2024-8072

Mage AI exposes a vulnerability (CVE-2024-8072) that allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users. Public details across sources consistently describe the issue as an information disclosure involving the terminal history, with no explicit ...

CVE-2024-45190

Mage AI suffers a path-traversal vulnerability in the Pipeline Interaction request that lets remote attackers with the Viewer role leak arbitrary files from the Mage server. The issue stems from improper handling of file paths, enabling access to sensitive server files and exposing confidentialit...

CVE-2024-45188

CVE-2024-45188 affects Mage AI and describes a path-traversal vulnerability in the File Content request that lets remote users with the Viewer role leak arbitrary files from the Mage server. The issue centers on improper validation of file paths, enabling access to files outside the intended scop...