AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-pqcv-qw2r-r859

MLFlow improper input validation

MLflow

CVE-2024-37061 · Published Jun 4, 2024 · updated Sep 10, 2026

High8.8
No fix yet
GitHub advisory

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
>= 1.11.0, <= 2.13.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-20, CWE-94
Also known as
BIT-mlflow-2024-37061, CVE-2024-37061, PYSEC-2026-1657

More MLflow advisories

All MLflow
High 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37060no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37058no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37057no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37059no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37053no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37052no fix yet