AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-x38x-g6gr-jqff

MLFlow unsafe deserialization

MLflow

CVE-2024-37055 · Published Jun 4, 2024 · updated Jul 7, 2026

High8.8
No fix yet
GitHub advisory

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
>= 1.24.0, <= 2.14.1No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
BIT-mlflow-2024-37055, CVE-2024-37055, PYSEC-2026-1663

More MLflow advisories

All MLflow
High 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37060no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37058no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37057no fix yetHigh 8.8Jun 4, 2024MLFlow improper input validationCVE-2024-37061no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37059no fix yetHigh 8.8Jun 4, 2024MLFlow unsafe deserializationCVE-2024-37053no fix yet