Threats tagged 'bit-mlflow-2024-0520'

A critical remote code execution vulnerability exists in mlflow versions prior to 2.9.1. The flaw arises from improper sanitization of filenames derived from HTTP Content-Disposition headers or URL paths when loading datasets, allowing attackers to perform arbitrary file writes via path traversal or absolute paths. This can lead to execution of malicious commands on the affected system. The issue is fixed in version 2.9.0.