Cross-site Scripting in MLFlow

심각 9.6CVE-2024-27132 · BIT-mlflow-2024-27132 · GHSA-6749-m5cp-6cg7 · Published 23/02/2024 · updated 17/06/2026

요약

CVE-2024-27132은(는) mlflow, mlflow (lfprojects)에 영향을 주는 심각 (CVSS 9.6) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.88%, 전체 취약점의 59.1%보다 높음.
조치: 2.10.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mlflow PyPI	`< 2.10.0`	`2.10.0`
mlflow lfprojects	`≤ 2.9.2`	No fix yet

Description

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook.

The vulnerability stems from lack of sanitization over template variables.

NVD description

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables.

References

nvd.nist.gov/vuln/detail/CVE-2024-27132 · ADVISORY
mlflow/mlflow#10873 · WEB
mlflow/mlflow · PACKAGE
pypa/advisory-database · WEB
research.jfrog.com/vulnerabilities/mlflow-untrusted-recipe-xss-jfsa-2024-000631930 · WEB
research.jfrog.com/vulnerabilities/mlflow-untrusted-recipe-xss-jfsa-2024-000631930 · Exploit
GitHub Advisory GHSA-6749-m5cp-6cg7 · ADVISORY

mlflow의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mlflow

PyPI

< 2.10.0

2.10.0

mlflow

lfprojects

≤ 2.9.2

No fix yet

Description

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook.

The vulnerability stems from lack of sanitization over template variables.

NVD description

mlflow의 다른 취약점

모두 보기 →