zenml 0.61.0

Direct Vulnerabilities

Known vulnerabilities in the zenml package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Missing Authorization zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Missing Authorization in the `get_deployed_stack` endpoint. An attacker can access sensitive information, including infrastructure topology, service connector details, stack ownership, and deployment metadata, by sending authenticated requests to the affected endpoint, which lacks proper authorization checks. This exposure may enable cross-tenant reconnaissance and facilitate further attacks in multi-tenant environments. How to fix Missing Authorization? Upgrade `zenml` to version 0.95.0 or higher.	[,0.95.0)
H Deserialization of Untrusted Data zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the `cloudpickle.load` process in `cloudpickle_materializer.py`. An attacker can execute arbitrary system commands by placing a malicious pickle file with a crafted `__reduce__` method in a shared artifact store, which is then deserialized by unsuspecting users or pipelines. How to fix Deserialization of Untrusted Data? Upgrade `zenml` to version 0.96.3 or higher.	[,0.96.3)
M User Impersonation zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to User Impersonation in the `POST /api/v1/login` and self password-change endpoints when the rate limiter uses `request.client.host` derived from the `X-Forwarded-For` header. An attacker can circumvent request throttling by rotating the `X-Forwarded-For` header, enabling unthrottled credential guessing attacks. This is only exploitable if Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. How to fix User Impersonation? Upgrade `zenml` to version 0.95.0 or higher.	[,0.95.0)
M Directory Traversal zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Directory Traversal via the `load()` function in the `PathMaterializer` class during extraction of `data.tar.gz` archives. An attacker can overwrite arbitrary files, potentially leading to command execution, by crafting archives containing symbolic or hard links that bypass directory validation. How to fix Directory Traversal? Upgrade `zenml` to version 0.84.2 or higher.	[,0.84.2)
H Infinite loop zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Infinite loop through the multipart request boundary processing mechanism. An attacker can cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. How to fix Infinite loop? Upgrade `zenml` to version 0.68.0 or higher.	[,0.68.0)
M Cross-site Request Forgery (CSRF) zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) in the `generate_access_token()` function in `auth.py`. How to fix Cross-site Request Forgery (CSRF)? Upgrade `zenml` to version 0.73.0 or higher.	[,0.73.0)
H Race Condition within a Thread zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Race Condition within a Thread in the `ServiceConnectorRegistry` class in `service_connector_registry.py`, causing errors that block access to certain service connector types when concurrent REST requests are made. How to fix Race Condition within a Thread? Upgrade `zenml` to version 0.71.0 or higher.	[,0.71.0)
M Incorrect Authorization zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Incorrect Authorization due to improper RBAC enforcement. How to fix Incorrect Authorization? Upgrade `zenml` to version 0.72.0 or higher.	[,0.72.0)
L Insufficient Session Expiration zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper session management mechanism. An attacker can maintain unauthorized access and perform actions as a legitimate user by reusing old session credentials or session IDs after a password change. The vulnerability arises when sessions do not expire immediately after a password change, allowing the session to remain active and usable in another browser without requiring re-authentication. How to fix Insufficient Session Expiration? There is no fixed version for `zenml`.	[0.56.3,)

Vulnerability

Vulnerable Version

Missing Authorization