A flaw was found in MLflow's dspy flavor. The security control intended to prevent pickle deserialization is only enforced when the model file path ends with '.pkl'. This oversight allows a remote attacker to bypass the security control and execute arbitrary code by providing a specially crafted MLmodel artifact.
Fix evidence last checked: 2026-10-21 19:16 UTC