Headline
GHSA-cwgg-w6mp-w9hg: MLFlow unsafe deserialization
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.
MLFlow unsafe deserialization
High severity GitHub Reviewed Published Jun 4, 2024 to the GitHub Advisory Database • Updated Jun 5, 2024