CVE-2024-37059: Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling

CVE-2024-37059 is a vulnerability in MLflow (a platform for managing machine learning workflows) version 0.5.0 and newer where deserialization of untrusted data (converting data from an external format into usable code without verifying it's safe) can occur. An attacker can upload a malicious PyTorch model (a type of machine learning model file) that executes arbitrary code (runs any commands they choose) on a user's computer when the model is opened or used.