~ / search / GHSA-cv6c-7963-wxcg

GHSA-cv6c-7963-wxcg

MLFlow unsafe deserialization

Source: GitHub Advisory Database (reviewed) High CVE-2024-37060

Packages

EcosystemPackageAffectedFixed in
PyPI mlflow >= 1.27.0, <= 2.14.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.

References

External links from the advisory. They lead to third-party sites.