VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control
CERT/CC warns MLflow's dspy and statsmodels flavors bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control, enabling remote code execution.
CERT/CC vulnerability note VU#369093 describes a flaw in MLflow 3.12.0 where the dspy flavor conditionally applies the pickle deserialization safety control based only on the model path's .pkl extension, while the statsmodels flavor skips the check entirely, permitting arbitrary code execution via malicious pickle payloads even when users disallow pickle. The statsmodels flavor is patched in versions 3.15.0 and later, but no dspy fix exists yet, so users should avoid loading models through that flavor. Exploitation requires write access to any location from which a user obtains MLflow models.
- dspy flavor checks only the .pkl extension; renamed pickle files bypass the control
- statsmodels flavor ignores MLFLOW_ALLOW_PICKLE_DESERIALIZATION entirely
- Patched in statsmodels flavor versions 3.15.0 and later; no dspy fix yet
- Attack requires write access to MLflow model storage locations
- Products
- MLflow
From the original article
2 min read at kb.cert.orgOverview A vulnerability in MLflow’s dspy and statsmodels model flavors allows unauthorized pickle deserialization executions despite a safety control. Specifically, the dspy flavor conditionally applies the control based on the model path’s file extension, and the statsmodels flavor does not apply the control.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.