{"action":"Upgrade scikit-learn to 1.5.0 or later.","affected":[{"fixed":"1.5.0","introduced":"0"}],"component":"scikit-learn","cve_ids":["CVE-2024-5206"],"ecosystem":"PyPI","epss":0.00189,"exploited":false,"fixed_versions":["1.5.0"],"ghsa_id":"GHSA-jw8x-6495-233v","id":"tcs_01M5KGKY7RX9EDQCFMB2M3QSSQ","modified_at":"2026-06-10T17:02:43.910139851Z","published_at":"2024-06-06T19:16:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-110","https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c","https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8","https://github.com/advisories/GHSA-jw8x-6495-233v"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"PYSEC-2024-110","url":"https://osv.dev/vulnerability/PYSEC-2024-110"}],"summary":"A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability a"}