Low
osv
·
PYSEC-2026-1657
MLFlow improper input validation
Published Jul 7, 2026
CVSS 3.1
Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input.
Affected AI Products
mlflow