Directory Traversal

mlflow is vulnerable to Directory Traversal. The vulnerability exists in the validatepathissafe function within uri.py which allows an attacker to read or write to files outside of the restricted directory using a crafted file path...

mlflow Command Injection vulnerability

with only one user interactiondownload a malicious config, attackers can gain full command execution on the victim system...

GHSA-HVC6-42VF-JHF8 mlflow Command Injection vulnerability

with only one user interactiondownload a malicious config, attackers can gain full command execution on the victim system...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2023-6940 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2023-6940 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2023-6940 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2023-6940 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-6940 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

azureml-contrib-run (>=1.0.72, <=1.0.74), azureml-mlflow (>=1.0.72.1, <=1.0.74) potentially affected by CVE-2023-6940 via mlflow (1.3.0)

mlflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.72, =1.0.72.1, =1.0.74 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6940 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

deepsleep (1.0.3) potentially affected by CVE-2023-6940 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

dbnd-mlflow (>=0.25.14, <=0.81.4), nerblackbox (>=0.0.5, <=0.0.10) potentially affected by CVE-2023-6940 via mlflow (1.6.0)

mlflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dbnd-mlflow =0.25.14, =0.0.5, =0.0.10 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2023-6940 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

nerblackbox (>=0.0.11, <=0.0.13), qacaller (>=0.0.1, <=0.1.2) potentially affected by CVE-2023-6940 via mlflow (1.8.0)

mlflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - nerblackbox =0.0.11, =0.0.1, =0.1.2 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2023-6940 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2023-6940 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2023-6940 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2023-6940 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2023-6940 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2023-6940 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...