17 matches found
CVE-2026-0596-Reproduction
CVE-2026-0596: MLflow 에코시스템의 안전하지 않은 역직렬화를 통한 임의 코드 실행 mlflow==2.11.1 및 mlserver==1.3.5 내 신뢰할 수 없는 모델 로딩 파이프라인과 관련된 검증, 기본 메커니즘 및 아키텍처 취약점을 상세히 설명하는 포괄적인 보안 연구 보고서입니다. ⚠️ 취약점 인텔리전스 권고: CVE-2026-0596 항목| 세부 정보 ---|--- 취약점 ID| CVE-2026-0596 / GHSA-rvhj-8chj-8v3c 공통 취약점 열거CWE| CWE-78: OS 명령에 사용되는 특수...
PYSEC-2026-424 Mlflow: Command Injection when serving models with enable_mlserver=True
A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for command...
Mlflow: Command Injection when serving models with enable_mlserver=True
A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for command...
Exploit for OS Command Injection in Lfprojects Mlflow
Below is a structured, markdown-formatted vulnerability research...
BIT-MLFLOW-2026-0596 Command Injection in mlflow/mlflow
A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...
CVE-2026-0596
A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection when serving models with enablemlserver=True due to unsanitized input being embedded into a shell command. An attacker can execute arbitrary commands by supplying specially crafted model URIs containing shell...
Mlflow: Command Injection when serving models with enable_mlserver=True
A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for command...
Command Injection
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Command Injection when serving models with enablemlserver=True due...
GHSA-RVHJ-8CHJ-8V3C Mlflow: Command Injection when serving models with enable_mlserver=True
A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for command...
CVE-2026-0596
A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...
CVE-2026-0596 Command Injection in mlflow/mlflow
A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...
CVE-2026-0596
A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...
CVE-2026-0596
The CWE/CVE describes a command-injection in mlflow/mlflow when serving a model with enable_mlserver=True. The vulnerability occurs because model_uri is embedded directly into a shell command executed via bash -c without sanitization, allowing shell metacharacters (e.g., $(), backticks) to enable...
CVE-2026-0596 Command Injection in mlflow/mlflow
A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...
PT-2026-29269
Name of the Vulnerable Software and Affected Versions mlflow/mlflow affected versions not specified Description A command injection issue exists in mlflow/mlflow when serving a model with enable mlserver=True. The model uri is directly incorporated into a shell command executed using bash -c...
MLflow 操作系统命令注入漏洞
MLFlow is an open-source platform that simplifies machine learning development. It includes features for tracking experiments, packaging code for reproducible executions, and sharing and deploying models. MLFlow has a vulnerability related to operating system command injection. This vulnerability...