CVE-2024-37053: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling

CVE-2024-37053 is a vulnerability in MLflow (a machine learning platform) version 1.1.0 and newer where deserialization of untrusted data (the process of converting saved data back into usable code without checking if it's safe) can occur. An attacker can upload a malicious scikit-learn model (a machine learning library) that runs arbitrary code (any commands the attacker chooses) on a user's computer when the model is loaded and used.