azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2024-8859 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

deepsleep (1.0.3) potentially affected by CVE-2024-8859 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-8859 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2024-8859 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

sapsan (>=0.6.1, <=0.6.2) potentially affected by CVE-2024-8859 via mlflow (1.25.0)

mlflow PYPI version 1.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sapsan =0.6.1, =0.6.2 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

mlfields (0.0.0), poms (0.0.0) potentially affected by CVE-2024-8859 via mlflow (1.20.1)

mlflow PYPI version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlfields 0.0.0 - poms 0.0.0 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2024-8859 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

flown (>=0.0.1, <=0.1.0) potentially affected by CVE-2024-8859 via mlflow (1.17.0)

mlflow PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - flown =0.0.1, =0.1.0 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

a2 (>=0.1.0, <=0.3.17), ikomia (>=0.9.0, <=0.13.0) +2 more potentially affected by CVE-2024-8859 via mlflow (1.30.0)

mlflow PYPI version 1.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - a2 =0.1.0, =0.9.0, =0.13.0 - mantik 0.1.2 - pyrovelocity 0.1.1 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

openstef (>=3.2.0a0, <=3.2.6) potentially affected by CVE-2024-8859 via mlflow (1.25.1)

mlflow PYPI version 1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - openstef =3.2.0a0, =3.2.6 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

auf (>=1.0.0, <=2.0.1), auto-mlflow (1.0.0) +77 more potentially affected by CVE-2024-8859 via mlflow (>=2.0.0rc0, <=2.16.2)

mlflow PYPI version =2.0.0rc0, =1.0.0, =1.0.1, =0.1.0, =0.0.4, =0.1.3, =0.1.2, =1.2.0, =0.8.0, =0.0.10, =0.0.1, =0.0.9, =1.0.16, =1.1.0 and more Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2024-8859 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

iqradre (>=0.1.5, <=0.2.1) potentially affected by CVE-2024-8859 via mlflow (1.20.0)

mlflow PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - iqradre =0.1.5, =0.2.1 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2024-8859 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

biome-text (3.3.0), elemeno-ai-sdk (>=0.0.8, <=0.2.4) +5 more potentially affected by CVE-2024-8859 via mlflow (1.20.2)

mlflow PYPI version 1.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text 3.3.0 - elemeno-ai-sdk =0.0.8, =0.0.1, =0.2.1.2, =0.1.5, =2.5.1a1, =0.0.1, =0.0.48 Source cves: CVE-2024-8859 Source advisory:...

mlflow-asus-aimaker (>=0.0.6, <=1.0.2), newsmodel (0.1.0) +3 more potentially affected by CVE-2024-8859 via mlflow (1.24.0)

mlflow PYPI version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-asus-aimaker =0.0.6, =1.3.0, =3.1.1, =3.1.4, =3.1.6 Source cves: CVE-2024-8859 Source advisory: OSV:PYSEC-2026-1638...

CVE-2024-8859

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...

dbnd-mlflow (>=0.25.14, <=0.81.4), nerblackbox (>=0.0.5, <=0.0.10) potentially affected by CVE-2024-8859 via mlflow (1.6.0)

mlflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dbnd-mlflow =0.25.14, =0.0.5, =0.0.10 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2024-8859 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...

sapsan (>=0.6.1, <=0.6.2) potentially affected by CVE-2024-8859 via mlflow (1.25.0)

mlflow PYPI version 1.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sapsan =0.6.1, =0.6.2 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...