A deserialization vulnerability in MLflow's SHAP load_explainer function allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. This flaw arises from improper validation of user-supplied data during the loading of SHAP explainer models, enabling code execution in the context of the current user.