Attributed metadata history

VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control

Overview Two vulnerabilities in MLflow’s dspy and statsmodels model flavors allow unauthorized pickle deserialization executions despite a safety control. Specifically, the dspy flavor conditionally applies the control based on the model path’s file extension, and the statsmodels flavor does not apply the control. Description MLflow is an open-source platform for managing machine learning lifecycl

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.