PT-2024-27269 · Mlflow · Mlflow
CVE-2024-37054
·
Published
2024-06-04
·
Updated
2026-07-07
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MLflow platform versions 0.9.0 and newer
Description
The issue allows deserialization of untrusted data, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user's system when interacted with.
Recommendations
For MLflow platform versions 0.9.0 and newer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mlflow