Home » Database

AVID-2026-R1496

Description

Vulnerability CVE-2024-37061

Details

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.

Reason for inclusion in AVID: CVE-2024-37061 describes a remote code execution vulnerability in MLflow (versions 1.11.0+), triggered by a maliciously crafted MLproject, enabling arbitrary code execution on the end user’s system. MLflow is a core tool used in AI/ML pipelines for building, training, packaging, deploying, and serving AI models, making this vulnerability relevant to AI systems. The issue affects a software component used to build/run AI systems, which places it in the general-purpose AI software supply chain. It is a security vulnerability (code execution) with explicit CVE details and references, satisfying AVID’s criteria for exposure in AI supply chains.

References

Affected or Relevant Artifacts

  • Developer: MLflow
  • Deployer: MLflow
  • Artifact Details:
TypeName
SystemMLflow

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-94CWE-94 Improper Control of Generation of Code (‘Code Injection’)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-06-04
  • Version: 0.3.3
  • AVID Entry