p PatchFirst

CVE-2024-37058

CVE-2024-37058

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.

CVSS 8.8 · High · EPSS 0.6%

Published
Updated

Stack: python

Affected products and versions

  • mlflow

    Versions
    • ≥ 2.5.0: Affected (semver)

    No fix published

  • mlflow PyPI

    Versions
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.11.3
    • 2.11.4
    • 2.12.0
    • 2.12.1
    • 2.12.2
    • 2.13.0
    • 2.13.1
    • 2.13.2
    • 2.14.0
    • 2.14.0rc0
    • 2.14.1
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.7.1
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 2.9.1
    • 2.9.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.5.0, ≤ 2.14.1

    No fix published

Original sources

Check your server →