CVE-2024-37060 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37060

The CVE-2024-37060 entry corresponds to a deserialization of untrusted data in MLflow 1.27.0 and newer, allowing a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. The root cause is described as unsafe pickle deserialization in the Recipe handling path (recip...

CVE-2024-37060

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...