MLflowGHSA-pqcv-qw2r-r859

MLFlow improper input validation

High8.8CVE-2024-37061 · Published Jun 4, 2024 · updated Sep 10, 2026

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input.

GitHub advisory

Affected versions

Package	Affected	Fixed in
mlflow PyPI	>= 1.11.0, <= 2.13.1	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20, CWE-94
Also known as: BIT-mlflow-2024-37061, CVE-2024-37061, PYSEC-2026-1657

More MLflow advisories

All MLflow

Date	Advisory	Severity	Fixed in
Jun 42024	MLFlow unsafe deserialization High8.8Jun 4, 2024 CVE-2024-37060No fix yet	High8.8	No fix yet
Jun 42024	MLFlow unsafe deserialization High8.8Jun 4, 2024 CVE-2024-37058No fix yet	High8.8	No fix yet
Jun 42024	MLFlow unsafe deserialization High8.8Jun 4, 2024 CVE-2024-37057No fix yet	High8.8	No fix yet
Jun 42024	MLFlow unsafe deserialization High8.8Jun 4, 2024 CVE-2024-37059No fix yet	High8.8	No fix yet
Jun 42024	MLFlow unsafe deserialization High8.8Jun 4, 2024 CVE-2024-37053No fix yet	High8.8	No fix yet
Jun 42024	MLFlow unsafe deserialization High8.8Jun 4, 2024 CVE-2024-37052No fix yet	High8.8	No fix yet

Affected versions

More MLflow advisories

Critical advisories by email