mlflow/mlflow

5 results · Clear filters · Feed

• Critical 9.6
  CVE-2026-0596 Public exploit

  Command Injection in mlflow/mlflow

  A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacha…

  MLflow mlflow/mlflow mlflow PyPI
  Mar 31, 2026
• High 7.5
  CVE-2024-8859 Public exploit Scanner template

  Path Traversal in mlflow/mlflow

  A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the pat…

  MLflow mlflow/mlflow mlflow PyPI
  Mar 20, 2025
• High 7.5
  CVE-2024-2928 Public exploit Scanner template EPSS 22%

  Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

  A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal s…

  MLflow mlflow/mlflow mlflow PyPI
  Jun 6, 2024
• Critical 10.0
  CVE-2024-0520 Public exploit

  Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

  A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a…

  MLflow mlflow/mlflow mlflow PyPI
  Jun 6, 2024
• Critical 9.3
  CVE-2023-1177 Public exploit Scanner template EPSS 70%

  Path Traversal: '\..\filename' in mlflow/mlflow

  Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

  MLflow mlflow/mlflow mlflow PyPI
  Mar 24, 2023