PT-2024-27271 · Mlflow +2 · Mlflow +2

Name of the Vulnerable Software and Affected Versions: MLflow versions 1.23.0 and newer Description: The issue allows deserialization of untrusted data, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user's system when interacted with. Recommendations:...