{"id":"CVE-2024-37054","aliases":["GHSA-ghv6-9r9j-wh4j","BIT-mlflow-2024-37054","PYSEC-2026-1651"],"title":"MLFlow unsafe deserialization","summary":"MLFlow unsafe deserialization","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"mlflow","product":"mlflow","ecosystem":"pip","affected":["mlflow >= 0.9.0, <= 2.14.1"],"published":"2024-06-04","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-ghv6-9r9j-wh4j","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37054"},{"url":"https://github.com/mlflow/mlflow"},{"url":"https://hiddenlayer.com/sai-security-advisory/mlflow-june2024"}],"tags":["osv","pip","exploit-available"],"epss":0.00703,"epssPercentile":0.51848,"ingestedAt":"2026-07-08T18:25:49.723Z","exploits":{"github":6,"githubRepos":["https://github.com/NiteeshPujari/CVE-2024-37054-MLflow-RCE","https://github.com/ben-slates/CVE-2024-37054","https://github.com/jimmexploit/CVE-2024-37054-PoC"],"checkedAt":"2026-09-23T07:13:29.659Z"},"exploitAvailable":true,"slug":"CVE-2024-37054","body":"## Overview\n\nDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.\n\n## Affected packages\n\n- `mlflow >= 0.9.0, <= 2.14.1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4720,"id":"CVE-2024-37054","ts":1788887202333,"field":"exploit_available","old":"false","new":"true"},{"seq":3603,"id":"CVE-2024-37054","ts":1788886318435,"field":"exploit_available","old":"true","new":"false"},{"seq":2457,"id":"CVE-2024-37054","ts":1788882987067,"field":"exploit_available","old":"false","new":"true"},{"seq":1486,"id":"CVE-2024-37054","ts":1788882400484,"field":"exploit_available","old":"true","new":"false"},{"seq":600,"id":"CVE-2024-37054","ts":1788881836991,"field":"exploit_available","old":"false","new":"true"}]}