CVE-2024-37054: Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling

CVE-2024-37054 is a vulnerability in MLflow (a machine learning platform) version 0.9.0 and newer that allows deserialization of untrusted data (unsafe processing of data from untrusted sources). An attacker can upload a malicious PyFunc model (a machine learning model format) that runs arbitrary code (any commands an attacker wants) on a user's computer when the model is used.