Evidence · DiggingBeagle record
MLflow scorer module import before scoring, GHSA-26p8-2jq9-3vq9
Maintainer advisory and reproducible Docker proof of execution when a user-controlled scorer module is imported before evaluation.
- Source role
- primary disclosure
Evidence record
Maintainer advisory and reproducible Docker proof of execution when a user-controlled scorer module is imported before evaluation.
Claim-level citations (2)
- supportsMLflow scorer imports executed Python before a scoring request: The MLflow scorer advisory demonstrates importing a caller-uploaded Python module through the scorer endpoint on a default unauthenticated 3.14.0 Docker server, with a harmless execution marker appearing before the request failed.
GHSA-26p8-2jq9-3vq9: Impact, attack prerequisites, Docker reproduction and fixed release
- supportsMLflow scorer imports executed Python before a scoring request: MLflow imported a user-controlled Python scorer module from an allowed third-party module prefix before checking the request as a scoring job. The attack presupposes an affected MLflow server with a writable module namespace, including the demonstrated official 3.14.0 Docker image. The maintainer reproduced a command-execution marker running with the server process authority before an eventual HTTP 500 response.
GHSA-26p8-2jq9-3vq9: Impact, attack prerequisites, Docker reproduction and fixed release