Insecure Temporary File in mlflow

HIGH 7.5CVE-2022-0736 · BIT-mlflow-2022-0736 · GHSA-vqj2-4v8m-8vrq · Published 23/02/2022 · updated 17/06/2026

In short

CVE-2022-0736 is a HIGH (CVSS 7.5) vulnerability affecting mlflow, mlflow (lfprojects).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.5% of all vulnerabilities.
Fix: update to 1.23.1 or later.

Package	Affected versions	Patched versions
mlflow PyPI	`< 1.23.1`	`1.23.1`
mlflow lfprojects	`< 1.23.1`	`1.23.1`

Description

mlflow prior to 1.23.1 contains an insecure temporary file. The insecure function tempfile.mktemp() is deprecated and mkstemp() should be used instead.

NVD description

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.

References

nvd.nist.gov/vuln/detail/CVE-2022-0736 · ADVISORY
mlflow/mlflow commit 61984e6 · WEB
GitHub Advisory GHSA-vqj2-4v8m-8vrq · ADVISORY
mlflow/mlflow · PACKAGE
pypa/advisory-database · WEB
huntr.dev/bounties/e5384764-c583-4dec-a1d8-4697f4e12f75 · WEB

More vulnerabilities in mlflow

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mlflow

PyPI

< 1.23.1

1.23.1

mlflow

lfprojects

< 1.23.1

1.23.1

More vulnerabilities in mlflow

See all →