EUVD-2026-19608
GHSA-fh64-r2vc-xvhr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.
This issue affects MLflow version through 3.10.1
AnalysisAI
Stored cross-site scripting (XSS) in MLflow through version 3.10.1 allows authenticated attackers to inject malicious payloads via YAML-based MLmodel artifacts that execute when other users view the artifact in the web interface, enabling session hijacking or unauthorized actions on behalf of victims. CVSS 5.1 reflects low severity due to authentication requirement and user interaction; SSVC framework rates exploitation as none, automatable as no, and technical impact as partial. Upstream fix is available in a GitHub PR, though no formally released patched version has been independently confirmed from provided data.
Technical ContextAI
MLflow's web interface parses YAML-based MLmodel artifact metadata without proper sanitization before rendering it in the browser context. The vulnerability resides in how the application deserializes and displays user-supplied YAML content to other authenticated users, violating CWE-79 (Improper Neutralization of Input During Web Page Generation). YAML parsers can inadvertently execute embedded HTML/JavaScript if output is not escaped. The CPE cpe:2.3:a:mlflow:mlflow:*:*:*:*:*:*:*:* indicates the entire MLflow product line from version 0 through 3.10.1 is in scope. The attack vector is network-based (AV:N) with low complexity (AC:L), but requires low-privilege authentication (PR:L) and user interaction (UI:P) to trigger-a user must browse the artifacts section after an authenticated attacker uploads a malicious MLmodel file.
RemediationAI
Upstream fix available via GitHub pull request https://github.com/mlflow/mlflow/pull/21435; a formally released patched version number is not confirmed from provided data, so verify the latest stable MLflow release incorporates this PR. As an immediate mitigation, restrict upload permissions for MLmodel artifacts to trusted users only and educate team members not to click artifact links from untrusted sources. Monitor artifact upload logs for suspicious YAML payloads containing HTML/script tags. Implement Content Security Policy (CSP) headers in your MLflow deployment to restrict inline script execution in the web UI, which would limit the impact of any unpatched stored XSS.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today