{"data":{"id":"e0d1a2d5-c714-4505-b564-91c292acc356","title":"GHSA-gqvg-gmmx-x4hm: MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact","summary":"MLflow's statsmodels flavor has a security control bypass that allows remote code execution (RCE, where an attacker can run commands on a system they don't own) even when pickle deserialization is disabled. The statsmodels flavor loads model files using pickle (a Python method for serializing objects) without checking the `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` security control, so an attacker can upload a malicious model artifact and execute arbitrary code when someone loads it with `mlflow.pyfunc.load_model()`.","solution":"Add a guard check to `mlflow/statsmodels/__init__.py` in the `_load_model` function that mirrors the pattern used in other flavors like sklearn. The fix imports `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` and related Databricks utilities, then raises an `MlflowException` if pickle deserialization is disabled and the code is not running in a Databricks environment, with an error message explaining that the statsmodels model requires pickle and directing users to set `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` to `'true'` to allow it.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-gqvg-gmmx-x4hm","publishedAt":"2026-09-01T17:04:30.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["model_theft"],"issueType":"vulnerability","affectedPackages":["mlflow@>= 2.1.0, < 3.15.0 (fixed: 3.15.0)"],"affectedVendors":[],"affectedVendorsRaw":["MLflow","statsmodels"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":true,"disclosureDate":"2026-09-01T17:04:30.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}