Executive brief
MLflow, a platform for managing the machine learning lifecycle, is vulnerable to a security flaw in its web interface. An attacker with basic account access can upload a specially crafted model file that, when viewed by another user (such as an administrator), executes malicious code in their browser. This could allow the attacker to steal login sessions or perform unauthorized actions on behalf of the victim.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in MLflow's UI due to the use of unsafe YAML parsing. Specifically, the application utilized `yaml.load()` from the `js-yaml` (v3.x) library to process MLmodel artifacts. This function supports JavaScript-specific YAML tags (such as `!!js/function`), allowing for arbitrary JavaScript execution. An authenticated attacker can upload a malicious MLmodel artifact that triggers this execution when viewed by other users. The issue is resolved in version 3.11.1 by migrating to `yaml.safeLoad()`, which restricts parsing to standard YAML types.
Affected products
- MLflow MLflow <= 3.10.1
Timeline
- 2026-03-06: patched: Fix merged into master branch via PR #21435
- 2026-04-07: disclosed: Initial disclosure by CERT.PL and GitHub Advisory Database
- 2026-04-07: advisory
References
- https://github.com/mlflow/mlflow/pull/21435
- https://cert.pl/en/posts/2026/04/CVE-2026-33865
- https://github.com/mlflow/mlflow/commit/aca4dd0ec88a12f7655155c224371280e9b45dda
- https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-93.yaml