A critical unauthenticated remote code execution vulnerability in the MindsDB Minds Platform allows attackers to execute arbitrary OS commands and access sensitive environment credentials.

The application fails to sanitize input in the Anton agent's scratchpad tool, which allows unauthenticated attackers to trigger arbitrary Python code execution via the /api/v1/responses/ endpoint. By configuring a custom LLM API key through an unprotected settings endpoint, an attacker can invoke this tool to gain full OS command execution.

Successful exploitation allows an attacker to achieve full remote code execution under the context of the user running the application. This poses a catastrophic risk, including the compromise of SSH keys, stored credentials, and environment secrets, which could lead to full system takeover and lateral movement within the network. The CVSS score of 10.0 reflects the maximum severity, as the vulnerability is remotely exploitable without authentication.

Immediate Action: Restrict access to the Minds Platform management endpoints via a firewall or VPN until an official patch is released by the vendor.

Proactive Monitoring: Monitor server logs for suspicious POST requests to /api/v1/responses/ and PUT requests to /api/v1/settings/ originating from untrusted IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing malicious Python syntax or unauthorized configuration changes to the LLM settings.

Public Exploit Available: Unknown

This is a critical security flaw that requires immediate attention due to its potential for total system compromise. Administrators should isolate the affected infrastructure immediately and prioritize applying the vendor security update as soon as it becomes available.