{"data":{"id":"8e37dfcc-82b9-48be-86e0-961f12587789","title":"CVE-2024-37053: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling…","summary":"CVE-2024-37053 is a deserialization of untrusted data flaw (CWE-502) in the MLflow platform, versions 1.1.0 and newer. A maliciously uploaded scikit-learn model can run arbitrary code on an end user's system when that user interacts with it. NVD has not yet provided an assessment, and HiddenLayer is listed as the source.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-37053","publishedAt":"2024-06-04T16:15:10.957Z","cveId":"CVE-2024-37053","cweIds":["CWE-502","CWE-502"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["mlflow@>= 1.1.0, <= 2.14.1"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["MLflow","scikit-learn"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MLflow deserialization of untrusted data via scikit-learn model","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00623,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-43c4-9qgj-x742"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:55.401Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}