Remote Code Execution (RCE) Affecting mlflow package, versions [,2.9.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.09% (39th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MLFLOW-6102483
- published 7 Jun 2024
- disclosed 6 Dec 2023
- credit kevin-mizu
How to fix?
Upgrade mlflow to version 2.9.0 or higher.
Overview
mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper neutralization of special elements within the mlflow.data.http_dataset_source.py module. An attacker can execute arbitrary code by manipulating the filename in the Content-Disposition header or the URL path to include malicious input.
References
CVSS Scores
version 3.1