PT-2026-127225

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0 through 3.16.x Description Third-party scorer deserialization in mlflow/genai/scorers/base.py allows the import of request-selected descendants of allowed modules rather than requiring an exact match. An attacker can use...