MLflow SHAP explainer loading deserialization flaw allows code execution
MLflow, an AI model tool, can be hacked through a malicious page or file.
Summary
A deserialization flaw when MLflow loads SHAP explainer models lets a remote attacker run code with the current user's privileges. Exploitation requires the user to visit a malicious page or open a malicious file.
Affected when
- User visits a malicious page or opens a malicious file
- Loading SHAP explainer models
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen