Skip to content
OpenAdvisories

Product · MLflow

mlflow/mlflow

55 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-0596 Public exploit

    Command Injection in mlflow/mlflow

    A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacha…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2024-0520 Public exploit

    Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

    A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.3
    CVE-2023-1177 Public exploit Scanner template EPSS 70%

    Path Traversal: '\..\filename' in mlflow/mlflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

    MLflow mlflow/mlflow mlflow PyPI