CVE-2024-37057: Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabli

CVE-2024-37057 is a vulnerability in MLflow (an open-source machine learning platform) versions 2.0.0rc0 and newer that allows deserialization of untrusted data (converting data from an untrusted source back into executable code). An attacker could upload a malicious TensorFlow model (a type of machine learning model) that runs arbitrary code (any commands an attacker chooses) on a user's computer when the model is loaded or used.