Skip to content
AI Sec Watch
HighVulnerability

GHSA-gqvg-gmmx-x4hm: MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-gqvg-gmmx-x4hm
Published
Record updated
View JSON
Affected
  • mlflow >= 2.1.0, < 3.15.0
Fixed in
3.15.0
  • released July 31, 2026, 32 days before disclosure

Summary

The mlflow.statsmodels flavor's _load_model calls statsmodels.iolib.api.load_pickle, which wraps pickle.load, without checking MLFLOW_ALLOW_PICKLE_DESERIALIZATION. An attacker who can place a crafted MLmodel artifact with a malicious model.pkl in an accessible artifact store can trigger code execution in any process calling mlflow.pyfunc.load_model() on it, even when the setting is False. Default deployments without basic-auth require no credentials to upload the artifact.

Mitigation

Add the missing MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard to mlflow/statsmodels/__init__.py, in _load_model, raising MlflowException when pickle deserialization is not allowed.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Topics

Related items