AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-ffw3-6378-cqgp

mlflow vulnerable to OS Command Injection

MLflow

CVE-2023-4033 · Published Aug 1, 2023 · updated Nov 22, 2024

High8.8
Fix: upgrade to 2.6.0 or later
GitHub advisory

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
< 2.6.02.6.0
Details and references
CVSS 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-78
Also known as
BIT-mlflow-2023-4033, CVE-2023-4033, PYSEC-2023-280

More MLflow advisories

All MLflow
Critical 10.0Nov 16, 2023MLflow allowed arbitrary files to be PUT onto the serverCVE-2023-6015fixed in 2.8.1Critical 10.0Jul 19, 2023MLflow Path Traversal vulnerabilityCVE-2023-3765fixed in 2.5.0Critical 9.8May 17, 2023mlflow Path Traversal vulnerabilityCVE-2023-2780fixed in 2.3.0High 7.5May 11, 2023mflow vulnerable to directory traversalCVE-2023-30172fixed in 2.0.0rc0CriticalMay 1, 2023Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIsGHSA-83fm-w79m-64r5fixed in 2.3.1High 10.0Apr 28, 2023Relative path traversal in mlflowCVE-2023-2356fixed in 2.3.1