Description
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Allegro.AI | ClearML | 0.17.0 – < 1.14.3 | 1.14.3 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 6 repositories
-
diegogarciayala/CVE-2024-24590-ClearML-RCE-CMD-POC ★ 9 · Jun 15, 2024
CVE-2024-24590 ClearML RCE&CMD POC
-
rippsec/CVE-2024-24590-ClearML-RCE-Exploit ★ 6 · Jun 13, 2024
CVE-2024-24590 – ClearML RCE via unsafe pickle artifact deserialization (0.17.0–1.14.2)
-
OxyDeV2/ClearML-CVE-2024-24590 ★ 6 · Jun 11, 2024
Proof of concept for CVE-2024-24590
-
sviim/ClearML-CVE-2024-24590-RCE ★ 4 · Jul 21, 2024
With this script you can exploit the CVE-2024-24590
-
junnythemarksman/CVE-2024-24590 ★ 1 · Jun 20, 2024
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end u…
-
j3r1ch0123/CVE-2024-24590 ★ 0 · Oct 7, 2024
Created this exploit for the Hack The Box machine, Blurry.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | clearml | >= 0.17.0, <= 1.14.1 | — | GHSA-cpcw-9h9m-wqw9 |
| PyPI | clearml | >= 0.17.0, < 1.14.3rc0 | 1.14.3rc0 | PYSEC-2026-1256 |