MLflow Statsmodels load can run code after user action (CVE-2024-37052)
The target must open a malicious page or file; ZDI rates the flaw CVSS 7.8.
Stories per day · 30 days
2 RSS
2 stories, newest first · one card per story
Stories tagged #statsmodels
VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control
CERT/CC warns MLflow's dspy and statsmodels flavors bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control, enabling remote code execution.
3