{"action":"Upgrade mlflow to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2024-0520"],"ecosystem":"PyPI","epss":0.02401,"exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-5q6c-ffvg-xcm9","id":"tcs_01M5KF1H0M6AY8AF8661C1378Y","modified_at":"2025-04-08T22:30:40.119861Z","published_at":"2024-06-06T21:30:35Z","references":["https://osv.dev/vulnerability/GHSA-5q6c-ffvg-xcm9","https://nvd.nist.gov/vuln/detail/CVE-2024-0520","https://github.com/mlflow/mlflow/commit/400c226953b4568f4361bc0a0c223511652c2b9d","https://github.com/mlflow/mlflow","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-239.yaml","https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-5q6c-ffvg-xcm9","url":"https://osv.dev/vulnerability/GHSA-5q6c-ffvg-xcm9"}],"summary":"Remote code execution in mlflow"}