CVE-2024-27133: MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution
(updated )
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.
References
- github.com/advisories/GHSA-3v79-q7ph-j75h
- github.com/mlflow/mlflow
- github.com/mlflow/mlflow/commit/c43823750bffa5b6abcc086683b15a068513b67b
- github.com/mlflow/mlflow/commit/cfa71879a884cc3520e23ccab998c9aa78fdf2b1
- github.com/mlflow/mlflow/pull/10893
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-241.yaml
- nvd.nist.gov/vuln/detail/CVE-2024-27133
- research.jfrog.com/vulnerabilities/mlflow-untrusted-dataset-xss-jfsa-2024-000631932
Code Behaviors & Features
Detect and mitigate CVE-2024-27133 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →