GHSA-cpcw-9h9m-wqw9

Allegro AI ClearML vulnerable to deserialization of untrusted data

Source: GitHub Advisory Database (reviewed) High CVE-2024-24590

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	clearml	>= 0.17.0, <= 1.14.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-24590 advisory
https://github.com/allegroai/clearml package
https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain web