VULNERABILITY INTELLIGENCE

CVE-2024-37055

CVSS score8.8 HIGH

EPSS probability0.62%

CISA KEVNot currently listed

Published2024-06-04

Last modified2026-06-17

Description

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.