GHSA-7p8j-qv6x-f4g4

MLFlow unsafe deserialization

Source: GitHub Advisory Database (reviewed) High CVE-2024-37056

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	mlflow	>= 1.23.0, <= 2.14.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-37056 advisory
https://github.com/mlflow/mlflow package
https://hiddenlayer.com/sai-security-advisory/mlflow-june2024 web