{"data":{"id":"31ea2fa8-d4f8-4508-af9e-4d47838ed517","title":"CVE-2022-0736: Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.","summary":"CVE-2022-0736 is an insecure temporary file weakness, classified as CWE-377, in the GitHub repository mlflow/mlflow prior to 1.23.1. The entry was published on 02/23/2022 and last modified on 11/21/2024, and NIST had not yet provided an NVD assessment. The source describes the weakness only at this level and does not state what an attacker gains or what preconditions apply.","solution":"Patch: https://github.com/mlflow/mlflow/commit/61984e6843d2e59235d82a580c529920cd8f3711 (the source lists it as a patch link, and it refers to the fix as the prior-to-1.23.1 change).","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-0736","publishedAt":"2022-02-23T14:15:14.420Z","cveId":"CVE-2022-0736","cweIds":["CWE-377"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@< 1.23.1 (fixed: 1.23.1)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mlflow/mlflow insecure temporary file","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01575,"epssCheckedAt":"2026-11-04T06:10:13.536Z","kevDateAdded":null,"advisoryAliases":["GHSA-vqj2-4v8m-8vrq"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:58:23.815Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-01-27T05:11:35.353Z","daysToFix":-27,"fixCheckedAt":"2026-10-29T21:48:56.745Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"1.23.1","matchedVersion":"1.23.1","fixReleasedAt":"2022-01-27T05:11:35.353Z","daysToFix":-27,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:48:56.595Z"}]}}