7.5
Élevée
CVE-2024-27133 Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset
Description
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MLflow 2.9 | premières → 2.9.2 | Pas de correctif indiqué |
Autres CVE de MLflow
Les 20 CVE de MLflow →
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation
5.8
Moyenne
CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
7.0
Élevée
CVE-2024-2928
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was…
7.5
Élevée
CVE-2024-3099
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by…
5.4
Moyenne