CVE-2024-27132

Fixed upstream EPSS <1%CVSS 7.5

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables.

Published 2024-02-23 · CVE record · OSV

Products: lfprojects mlflow

Fixed upstream