{"id":"CVE-2024-24590","aliases":["GHSA-cpcw-9h9m-wqw9","PYSEC-2026-1256"],"title":"Allegro AI ClearML vulnerable to deserialization of untrusted data","summary":"Allegro AI ClearML vulnerable to deserialization of untrusted data","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"clearml","product":"clearml","ecosystem":"pip","affected":["clearml >= 0.17.0, <= 1.14.1"],"published":"2024-02-06","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cpcw-9h9m-wqw9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24590"},{"url":"https://github.com/allegroai/clearml"},{"url":"https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain"}],"tags":["osv","pip","exploit-available"],"epss":0.02473,"epssPercentile":0.83838,"ingestedAt":"2026-07-08T18:25:48.418Z","exploits":{"github":6,"githubRepos":["https://github.com/OxyDeV2/ClearML-CVE-2024-24590","https://github.com/rippsec/CVE-2024-24590-ClearML-RCE-Exploit","https://github.com/diegogarciayala/CVE-2024-24590-ClearML-RCE-CMD-POC"],"checkedAt":"2026-09-24T07:52:51.107Z"},"exploitAvailable":true,"slug":"CVE-2024-24590","body":"## Overview\n\nDeserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.\n\n## Affected packages\n\n- `clearml >= 0.17.0, <= 1.14.1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[{"seq":4700,"id":"CVE-2024-24590","ts":1788887200221,"field":"exploit_available","old":"false","new":"true"},{"seq":3583,"id":"CVE-2024-24590","ts":1788886316706,"field":"exploit_available","old":"true","new":"false"},{"seq":2437,"id":"CVE-2024-24590","ts":1788882985443,"field":"exploit_available","old":"false","new":"true"},{"seq":1466,"id":"CVE-2024-24590","ts":1788882398733,"field":"exploit_available","old":"true","new":"false"},{"seq":580,"id":"CVE-2024-24590","ts":1788881835378,"field":"exploit_available","old":"false","new":"true"}]}