AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-j8mg-pqc5-x9gj

MLFlow unsafe deserialization

MLflow

CVE-2024-37057 · Published Jun 4, 2024 · updated Jul 7, 2026

High8.8
No fix yet
GitHub advisory

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
>= 2.0.0rc0, <= 2.14.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
BIT-mlflow-2024-37057, CVE-2024-37057, PYSEC-2026-1654

More MLflow advisories

All MLflow
High 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37060no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37058no fix yetHigh 8.8Jun 4, 2024MLFlow improper input validationCVE-2024-37061no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37059no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37053no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37052no fix yet