Advisoriesby IbisClearMLGHSA-cpcw-9h9m-wqw9
Allegro AI ClearML vulnerable to deserialization of untrusted data
No fix yet
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| clearml PyPI | >= 0.17.0, <= 1.14.1 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2024-24590, PYSEC-2026-1256