VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control
CERT/CC warns MLflow's dspy and statsmodels flavors bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control, enabling remote code execution.
CERT/CC vulnerability note VU#369093 describes a flaw in MLflow 3.12.0 where the dspy flavor conditionally applies the pickle deserialization safety control based only on the model path's .pkl extension, while the statsmodels flavor skips the check entirely, permitting arbitrary code execution via malicious pickle payloads even when users disallow pickle. The statsmodels flavor is patched in versions 3.15.0 and later, but no dspy fix exists yet, so users should avoid loading models through that flavor. Exploitation requires write access to any location from which a user obtains MLflow models.
50