Advisoriesby IbisMLflowGHSA-fh64-r2vc-xvhr
MLflow: cross-site scripting
Fix: upgrade to 3.11.1 or later
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.
This issue affects MLflow version through 3.10.1
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.11.1 | 3.11.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-mlflow-2026-33865, CVE-2026-33865, PYSEC-2026-93
- nvd.nist.gov/vuln/detail/CVE-2026-33865
- github.com/mlflow/mlflow/pull/21435
- github.com/mlflow/mlflow/commit/aca4dd0ec88a12f7655155c224371280e9b45dda
- afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
- cert.pl/en/posts/2026/04/CVE-2026-33865
- github.com/mlflow/mlflow
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-93.yaml
More MLflow advisories
All MLflow
MLflow is vulnerable to an authorization bypass affecting the AJAX endpointCVE-2026-33866fixed in 3.11.0rc0MLflow: remote code executionCVE-2026-0545no fix yetMlflow: Command Injection when serving models with enable_mlserver=TrueCVE-2026-0596fixed in 3.9.0MLflow Command Injection vulnerabilityCVE-2025-15379fixed in 3.8.1MLFlow path traversal vulnerabilityCVE-2025-15036fixed in 3.9.0rc0MLFlow allows Tracing + Assessments AccessCVE-2025-15381no fix yet