PyPI/mlflow: high 8.8
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
Action: Upgrade mlflow to 3.15.0 or later.
pip install mlflow==3.15.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.1.0 | 3.15.0 | - |
Fixed versions
| 3.15.0 |
Sources
- osv: GHSA-gqvg-gmmx-x4hm
- https://github.com/mlflow/mlflow/security/advisories/GHSA-gqvg-gmmx-x4hm
- https://github.com/mlflow/mlflow/pull/24686
- https://github.com/mlflow/mlflow/commit/38615289094a4b700a20b5d1dbfbe57bdfb0411f
- https://github.com/mlflow/mlflow
- https://github.com/mlflow/mlflow/releases/tag/v3.15.0
published · modified · JSON