PyPI/mlflow CVE-2023-4033: high 7.8, EPSS 1.25%

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.

Action: Upgrade mlflow to 2.6.0 or later.

pip install mlflow==2.6.0

Affected

Fixed versions

Sources

• osv: PYSEC-2023-280
• https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b
• https://huntr.dev/bounties/5312d6f8-67a5-4607-bd47-5e19966fa321
• https://github.com/advisories/GHSA-ffw3-6378-cqgp

CVE-2023-4033 · published 2023-08-01T01:15:00Z · modified 2026-06-10T17:02:19.924728317Z · JSON