CVE-2026-33865

A flaw was found in MLflow, a platform for managing the machine learning lifecycle. This Stored Cross-Site Scripting XSS vulnerability, a type of injection where malicious scripts are injected into trusted websites, is caused by the unsafe parsing of YAML-based MLmodel artifacts in its web...

CVE-2026-33865

MLflow is vulnerable to Stored Cross-Site Scripting XSS caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actio...