{"data":{"id":"0c00a8ab-1317-4233-84e5-7eb9c4a6263d","title":"CVE-2023-6709: Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to…","summary":"CVE-2023-6709 is an improper neutralization of special elements used in a template engine in the GitHub repository mlflow/mlflow, prior to 2.9.2. The record is tagged CWE-1336 and was published to NVD on 12/11/2023, with NVD assessment not yet provided.","solution":"Patch: the fix is available in commit 432b8ccf27fd3a76df4ba79bb1bec62118a85625 of the mlflow/mlflow repository. The source also lists a huntr.dev bounty page (https://huntr.com/bounties/9e4cc07b-6fff-421b-89bd-9445ef61d34d) under the Patch and Exploit tags.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-6709","publishedAt":"2023-12-12T09:15:07.083Z","cveId":"CVE-2023-6709","cweIds":["CWE-1336"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@< 2.9.2 (fixed: 2.9.2)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mlflow template engine injection via special element neutralization","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00937,"epssCheckedAt":"2026-11-05T18:10:04.295Z","kevDateAdded":null,"advisoryAliases":["GHSA-cxfr-5q3r-2rc2"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:37.624Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-12-14T05:30:49.658Z","daysToFix":2,"fixCheckedAt":"2026-10-29T21:46:34.975Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.9.2","matchedVersion":"2.9.2","fixReleasedAt":"2023-12-14T05:30:49.658Z","daysToFix":2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:34.823Z"}]}}