Remote Code Execution (RCE)

MLflow is vulnerable to remote code execution RCE. The vulnerability is due to insufficient restriction of allowed Python modules, which allows an attacker to upload a malicious module into a writable allowed package and execute arbitrary code through the scorer invocation endpoint...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsa...