Deserialization of untrusted data

2024-02-0615:15:00

PRIOn knowledge base

www.prio-n.com

deserialization

untrusted data

arbitrary code

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.5%

JSON

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

CPENameOperatorVersion
clearmlge0.17.0
clearmlle1.14.2

CPE	Name	Operator	Version
	clearml	ge	0.17.0
	clearml	le	1.14.2

References

hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/