{"action":"Upgrade mlflow to 2.10.0 or later.","affected":[{"fixed":"2.10.0","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2024-3573"],"ecosystem":"PyPI","epss":0.00733,"exploited":false,"fixed_versions":["2.10.0"],"ghsa_id":"GHSA-hq88-wg7q-gp4g","id":"tcs_01M5KGMPH30J6YF5RCRVHT54K2","modified_at":"2026-06-10T17:01:26.574516579Z","published_at":"2024-04-16T00:15:12Z","references":["https://osv.dev/vulnerability/PYSEC-2024-243","https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c","https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc","https://github.com/advisories/GHSA-hq88-wg7q-gp4g"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"PYSEC-2024-243","url":"https://osv.dev/vulnerability/PYSEC-2024-243"}],"summary":"mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_loc"}