CVE-2023-4033
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
There is an OS Command Injection vulnerability in the GitHub repository mlflow/mlflow prior to version 2.6.0.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary system commands, potentially leading to system compromise.
Recommendation
It is recommended to upgrade to version 2.6.0 or later to mitigate this vulnerability.
Other vulnerabilities in mlflow/mlflow
See all- CVE-2026-2652High
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled. Issues with the authentication mechanisms lead to a bypass of protections on routes such as the Job API and the OpenTelemetry trace ingestion API.
- CVE-2023-3765Critical
There is an absolute path traversal vulnerability in the GitHub repository mlflow/mlflow prior to version 2.5.0.
Original NVD description (English source)
OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.