a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +144 more potentially affected by CVE-2024-37053 via mlflow (>=1.20.0 <=2.14.1)

mlflow PYPI version =1.20.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 and more Source cves: CVE-2024-37053 Source advisory: OSV:GHSA-43C4-9QGJ-X742...

CVE-2024-37053

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...