Threats tagged 'ghsa-26p8-2jq9-3vq9'

MLflow versions from 3.12.0rc0 up to but not including 3.17.0 are vulnerable to unauthenticated remote code execution via a flaw in third-party scorer deserialization. The vulnerability arises because the server imports and instantiates Python classes from request-controlled module paths under allowed package prefixes, which can be exploited by uploading malicious Python modules into writable artifact directories within these allowed packages. This leads to arbitrary code execution with the privileges of the MLflow server process, which by default runs as root in the official image. The issue is critical and has a CVSS score of 9.8. A fix is available in MLflow 3.17.0.