{"action":"Upgrade mlflow to 3.15.0 or later.","affected":[{"fixed":"3.15.0","introduced":"2.1.0"}],"component":"mlflow","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.15.0"],"ghsa_id":"GHSA-gqvg-gmmx-x4hm","id":"tcs_01M5KFJ55TDM6HRBSACFYS5C34","modified_at":"2026-09-01T17:15:05.362285883Z","published_at":"2026-09-01T17:04:30Z","references":["https://osv.dev/vulnerability/GHSA-gqvg-gmmx-x4hm","https://github.com/mlflow/mlflow/security/advisories/GHSA-gqvg-gmmx-x4hm","https://github.com/mlflow/mlflow/pull/24686","https://github.com/mlflow/mlflow/commit/38615289094a4b700a20b5d1dbfbe57bdfb0411f","https://github.com/mlflow/mlflow","https://github.com/mlflow/mlflow/releases/tag/v3.15.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-gqvg-gmmx-x4hm","url":"https://osv.dev/vulnerability/GHSA-gqvg-gmmx-x4hm"}],"summary":"MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact"}