AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-cv6c-7963-wxcg

MLFlow unsafe deserialization

MLflow

CVE-2024-37060 · Published Jun 4, 2024 · updated Jul 7, 2026

High8.8
No fix yet
GitHub advisory

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
>= 1.27.0, <= 2.14.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
BIT-mlflow-2024-37060, CVE-2024-37060, PYSEC-2026-1647

More MLflow advisories

All MLflow
High 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37058no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37057no fix yetHigh 8.8Jun 4, 2024MLFlow improper input validationCVE-2024-37061no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37059no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37053no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37052no fix yet