mlflow-dspy-pickle-bypass-poc

MLflow DSPy Pickle Deserialization Bypass — PoC

Advisory: GHSA-v26q-23qw-4825 Affected: mlflow <= 3.12.0 with DSPy flavor (use_dspy_model_save=True) Fix PR: mlflow#23293 Severity: High — Arbitrary Code Execution at model load time

Summary

MLflow provides MLFLOW_ALLOW_PICKLE_DESERIALIZATION=false as a security control. The DSPy flavor loader bypasses this by calling dspy.load(..., allow_pickle=True) without checking the guard, allowing RCE from malicious model artifacts.

Reproduce

pip install mlflow==3.12.0 dspy==3.2.1 cloudpickle
export MLFLOW_ALLOW_PICKLE_DESERIALIZATION=false
python3 reproduce.py

Expected Output

Exception (AFTER RCE): Loading .pkl files can run arbitrary code... RCE CONFIRMED: MLFLOW_DSPY_RCE_BYPASS_CONFIRMED uid=1000(user) ...

Code executes BEFORE the exception is raised.

Fix

PR #23293 hoists the guard above the branch dispatch so both load paths are protected.