MLflow pickle deserialization flaw allows remote code execution
Opening a malicious file in MLflow can let attackers hack your computer.
Summary
An untrusted-data deserialization flaw in MLflow lets a remote attacker run code. The target must visit a malicious page or open a malicious file. The sources list 3.10.1 as the affected version.
Affected when
- The user visits a malicious page or opens a malicious file
What to do
The sources name no fixed version. Read the vendor's advisory, and do not open files or pages from unknown sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen