CVE-2024-45190 Mage AI pipeline interaction request remote arbitrary file leak

What is CVE-2024-45190?

CVE-2024-45190 is a medium-severity path traversal vulnerability in mage:mage-ai, published on 23 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Pipeline Interaction" request

Weakness: CWE-35

Which versions are affected by CVE-2024-45190?

3 open source packages ship an affected version, including mage-ai. It affects 1 product.

Products include Mage Mage-Ai.

How do I fix CVE-2024-45190?

No fix has been published for CVE-2024-45190 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-45190 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45190 exists.

Other vulnerabilities in mage:mage-ai

• CVE-2024-45187 Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution High 7.1
• CVE-2024-45188 Mage AI file content request remote arbitrary file leak Medium 6.5
• CVE-2024-45189 Mage AI git content request remote arbitrary file leak Medium 6.5
• CVE-2023-31143 Mage terminal user authentication not working properly Medium 5.9
• CVE-2024-8072 Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4mrc-w7jh-hx4j, PYSEC-2026-1597.