36 matches found
CVE-2026-0596-Reproduction
Below is a structured, markdown-formatted vulnerability research report tailored for a GitHub repository layout such as a README.md or a security-labs write-up. It outlines the context, architecture, reproduction steps, and remediation strategies based on your lab findings. CVE-2026-0596: Arbitra...
CVE-2026-109156
A flaw was found in MLServer. A remote attacker could achieve arbitrary file write by supplying a specially crafted environment archive containing path traversal sequences. Because the environment extraction handler does not adequately validate destination paths before unpacking, archive files ca...
CVE-2026-109156
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...
CVE-2026-109156
A path traversal vulnerability exists in SeldonIO MLServer up to version 1.6.1 . The flaw is located within the _extract_env function of the mlserver/env.py file, specifically involving the environment_tarball Handler. This issue allows for remote manipulation leading to unauthorized path access....
EUVD-2026-98452
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...
CVE-2026-109156 SeldonIO MLServer environment_tarball env.py _extract_env path traversal
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...
CVE-2026-109156
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...
CVE-2026-109156 SeldonIO MLServer environment_tarball env.py _extract_env path traversal
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...
CVE-2026-109156: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about th...
PT-2026-111407
Name of the Vulnerable Software and Affected Versions SeldonIO MLServer versions prior to 1.6.2 Description A remote path traversal issue exists within the environment tarball Handler. The flaw is located in the extract env function of the mlserver/env.py file, allowing an attacker to manipulate...
Seldon MLServer path traversal vulnerability
Seldon MLServer versions 1.6.1 and earlier have a path traversal vulnerability. This vulnerability stems from improper handling of the extractenv function in the environmenttarball Handler component. It may lead to path traversal attacks, and attackers can launch these attacks remotely...
mlserver-huggingface (>=1.2.0.dev14, <=1.2.0rc3), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-9856 via transformers (4.21.1)
transformers PYPI version 4.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - mlserver-huggingface =1.2.0.dev14, =1.0.0, =1.1.3 Source cves: CVE-2026-9856 Source advisory: OSV:PYSEC-2026-3929...
mlserver-huggingface (>=1.2.0.dev14, <=1.2.0rc3), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-9856 via transformers (4.21.1)
transformers PYPI version 4.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - mlserver-huggingface =1.2.0.dev14, =1.0.0, =1.1.3 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...
PYSEC-2026-424 Mlflow: Command Injection when serving models with enable_mlserver=True
A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for command...
Mlflow: Command Injection when serving models with enable_mlserver=True
A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for command...
mlserver-huggingface (>=1.2.0.dev14, <=1.2.0rc3), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-5241 via transformers (4.21.1)
transformers PYPI version 4.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - mlserver-huggingface =1.2.0.dev14, =1.0.0, =1.1.3 Source cves: CVE-2026-5241 Source advisory: OSV:GHSA-FGCW-684Q-JJ6R...
mlserver-huggingface (>=1.2.0.dev14, <=1.2.0rc3), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-5241 via transformers (4.21.1)
transformers PYPI version 4.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - mlserver-huggingface =1.2.0.dev14, =1.0.0, =1.1.3 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...
mlserver-huggingface (>=1.2.0.dev14, <=1.2.0rc3), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-4372 via transformers (4.21.1)
transformers PYPI version 4.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - mlserver-huggingface =1.2.0.dev14, =1.0.0, =1.1.3 Source cves: CVE-2026-4372 Source advisory: OSV:GHSA-29PF-2H5F-8G72...
mlserver-huggingface (>=1.2.0.dev14, <=1.2.0rc3), wildtime (>=1.0.0, <=1.1.3) potentially affected by CVE-2026-4372 via transformers (4.21.1)
transformers PYPI version 4.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - mlserver-huggingface =1.2.0.dev14, =1.0.0, =1.1.3 Source cves: CVE-2026-4372 Source advisory: OSV:PYSEC-2026-2289...
