CVE-2024-37052 is a deserialization vulnerability affecting MLflow platform versions from 1.1.0 through versions prior to 2.14.2. The vulnerability arises from the unsafe deserialization of untrusted data, specifically a maliciously uploaded scikit-learn model, which can lead to arbitrary code execution on the end user's system upon interaction with the model. This allows an attacker to execute code in the context of the user running MLflow. No CVSS score is provided, but the issue is rated high severity. A patch is available to fix this vulnerability.

Successful exploitation allows an attacker to execute arbitrary code on the system of an end user interacting with a maliciously crafted scikit-learn model uploaded to MLflow. This can lead to full compromise of the affected system depending on the privileges of the user running MLflow.

A patch is available for this vulnerability. Users should upgrade MLflow to version 2.14.2 or later to remediate this issue. Until patched, avoid interacting with untrusted or unauthenticated scikit-learn models within MLflow.