CVE-2023-4033 OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0

Description

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.

Affected products and versions

Product	Affected versions	Fixed in
mlflow/mlflow 2.6	earliest → < 2.6.0	2.6.0
MLflow 2.6	earliest → < 2.6.0	2.6.0

Other CVEs of mlflow/mlflow

The 55 CVEs of mlflow/mlflow →

CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper… 8.1 High CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI… 9.1 Critical CVE-2026-3198 MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API… 6.5 Medium CVE-2026-2651 A vulnerability in MLflow… 9.0 Critical