PYSEC-2026-1647
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2026-1647.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1647
- Aliases
-
- BIT-mlflow-2024-37060
- CVE-2024-37060
- GHSA-cv6c-7963-wxcg
- Published
- 2026-07-07T11:45:45.300777Z
- Modified
- 2026-07-07T17:56:56.982249781Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- MLFlow unsafe deserialization
- Details
-
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.
- References
Affected packages
PyPI / mlflow
Package
- Name
- mlflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/mlflow
Affected versions
1.*
1.27.0
1.28.0
1.29.0
1.30.0
1.30.1
2.*
2.0.0rc0
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2
2.10.0
2.10.1
2.10.2
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.13.2
2.14.0rc0
2.14.0
2.14.1