Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2024-37054

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-ghv6-9r9j-wh4j

MLFlow unsafe deserialization Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

gitlab/pypi/mlflow/CVE-2024-37054

MLFlow unsafe deserialization Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

pypa/mlflow/PYSEC-2026-1651

MLFlow unsafe deserialization Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

pysec/PYSEC-2026-1651

MLFlow unsafe deserialization Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.