Threats tagged 'bit-mlflow-2024-37056'

A deserialization vulnerability exists in the MLflow platform versions 1.23.0 up to but not including 2.14.2. This flaw allows a maliciously crafted LightGBM scikit-learn model uploaded to the platform to execute arbitrary code on the system of an end user who interacts with it. The vulnerability is classified as high severity. A patch is available to address this issue.