MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

GHSA-J8MG-PQC5-X9GJ MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

GHSA-PQCV-QW2R-R859 MLFlow improper input validation

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input...

GHSA-CV6C-7963-WXCG MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...

GHSA-CWGG-W6MP-W9HG MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

GHSA-PQCV-QW2R-R859 vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-PQCV-QW2R-R859 vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-43C4-9QGJ-X742 vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-7P8J-QV6X-F4G4 vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-X38X-G6GR-JQFF vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +144 more potentially affected by CVE-2024-37052 via mlflow (>=1.20.0 <=2.14.1)

mlflow PYPI version =1.20.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-37052 Source advisory: OSV:GHSA-76CG-CFHX-373F...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +130 more potentially affected by CVE-2024-37055 via mlflow (>=1.24.0 <=2.14.1)

mlflow PYPI version =1.24.0, =0.1.0, =0.0.5, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 - cortic =0.1.0 and more Source cves: CVE-2024-37055 Source advisory: OSV:GHSA-X38X-G6GR-JQFF...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +131 more potentially affected by CVE-2024-37056 via mlflow (>=1.23.0 <=2.14.1)

mlflow PYPI version =1.23.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 - cortic =0.1.0 and more Source cves: CVE-2024-37056 Source advisory: OSV:GHSA-7P8J-QV6X-F4G4...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +144 more potentially affected by CVE-2024-37053 via mlflow (>=1.20.0 <=2.14.1)

mlflow PYPI version =1.20.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-37053 Source advisory: OSV:GHSA-43C4-9QGJ-X742...

GHSA-GHV6-9R9J-WH4J vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-76CG-CFHX-373F vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-76CG-CFHX-373F MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...