7.5
High
CVE-2024-27133 Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset
Description
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MLflow 2.9 | earliest → 2.9.2 | No fix stated |
Other CVEs of MLflow
The 20 CVEs of MLflow →
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation
5.8
Medium
CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
7.0
High
CVE-2024-2928
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was…
7.5
High
CVE-2024-3099
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by…
5.4
Medium