VULNERABILITY INTELLIGENCE

CVE-2024-37058

CVSS score8.8 HIGH

EPSS probability0.62%

CISA KEVNot currently listed

Published2024-06-04

Last modified2026-06-17

Description

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.