GHSA-CV6C-7963-WXCG MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...

GHSA-WF7F-8FXF-XFXC MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

GHSA-PQCV-QW2R-R859 vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-J8MG-PQC5-X9GJ vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +112 more potentially affected by CVE-2024-37060 via mlflow (>=1.27.0 <=2.14.1)

mlflow PYPI version =1.27.0, =0.1.0, =0.0.5, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 - cortic =0.1.0 and more Source cves: CVE-2024-37060 Source advisory: OSV:GHSA-CV6C-7963-WXCG...

GHSA-CWGG-W6MP-W9HG vulnerabilities

Vulnerabilities for packages: mlflow...

autorad (=0.2.6), bernn (>=0.1.3 <=0.3.2) +31 more potentially affected by CVE-2024-37057 via mlflow (>=2.0.0rc0 <=2.14.1)

mlflow PYPI version =2.0.0rc0, =0.1.3, =1.2.0, =0.8.0, =0.0.10, =1.0.0, =0.0.1, =0.1.0, =1.10.2, =0.1.2, =1.2.7, =1.6.1, =0.2.9, =0.3.0 - llm-foundry =0.9.0 and more Source cves: CVE-2024-37057 Source advisory: OSV:GHSA-J8MG-PQC5-X9GJ...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

GHSA-PQCV-QW2R-R859 MLFlow improper input validation

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input...

GHSA-J8MG-PQC5-X9GJ MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

GHSA-GHV6-9R9J-WH4J vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +168 more potentially affected by CVE-2024-37054 via mlflow (>=0.9.0 <=2.14.1)

mlflow PYPI version =0.9.0, =0.1.0, =0.0.5, =0.1.2, =1.0.23, =0.0.1, =1.0.41, =1.4.0, =0.2.5, =0.1.3, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =1.0.0 and more Source cves: CVE-2024-37054 Source advisory: OSV:GHSA-GHV6-9R9J-WH4J...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

GHSA-76CG-CFHX-373F MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

GHSA-43C4-9QGJ-X742 vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +144 more potentially affected by CVE-2024-37052 via mlflow (>=1.20.0 <=2.14.1)

mlflow PYPI version =1.20.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-37052 Source advisory: OSV:GHSA-76CG-CFHX-373F...

GHSA-X38X-G6GR-JQFF vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-76CG-CFHX-373F vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +144 more potentially affected by CVE-2024-37053 via mlflow (>=1.20.0 <=2.14.1)

mlflow PYPI version =1.20.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-37053 Source advisory: OSV:GHSA-43C4-9QGJ-X742...

GHSA-GHV6-9R9J-WH4J MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...