CVE-2024-37053

HIGH8.8EPSS 0.44%

MLFlow unsafe deserialization

Published: 6/4/2024Modified: 1/28/2026

Also known as:GHSA-43c4-9qgj-x742BIT-mlflow-2024-37053

Description

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.

Affected packages (2)

Bitnami/mlflow>= 1.1.0, < 2.13.2
PyPI/mlflow>= 1.1.0, <= 2.14.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-37053
PATCHhttps://github.com/mlflow/mlflow
WEBhttps://hiddenlayer.com/sai-security-advisory/mlflow-june2024