MLflow

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function.

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled.

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system.

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn…

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository.

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled.

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries.

Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167.

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system w…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when intera…

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's file…

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1.