Medium severity5.4NVD Advisory· Published Apr 7, 2026· Updated Apr 20, 2026
CVE-2026-33865
CVE-2026-33865
Description
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.
This issue affects MLflow version through 3.10.1
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mlflowPyPI | < 3.11.1 | 3.11.1 |
Affected products
1Patches
1aca4dd0ec88aFix stored XSS via unsafe YAML parsing of MLmodel artifacts (#21435)
2 files changed · +2 −2
mlflow/server/js/src/experiment-tracking/components/artifact-view-components/ShowArtifactLoggedModelView.tsx+1 −1 modified@@ -447,7 +447,7 @@ mlflow.models.predict( getArtifact, ) .then((response: any) => { - const parsedJson = yaml.load(response); + const parsedJson = yaml.safeLoad(response); if (parsedJson.signature) { const inputs = Array.isArray(parsedJson.signature.inputs) ? parsedJson.signature.inputs
mlflow/server/js/src/experiment-tracking/components/experiment-logged-models/hooks/useValidateLoggedModelSignature.ts+1 −1 modified@@ -14,7 +14,7 @@ export const useValidateLoggedModelSignature = (loggedModel?: LoggedModelProto | const artifactLocation = getLoggedModelArtifactLocationUrl(MLMODEL_FILE_NAME, loggedModel.info.model_id); const blob = await getArtifactBlob(artifactLocation); - const yamlContent = (await lazyJsYaml()).load(await blob.text()); + const yamlContent = (await lazyJsYaml()).safeLoad(await blob.text()); const isValid = yamlContent?.signature?.inputs !== undefined && yamlContent?.signature?.outputs !== undefined;
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/mlflow/mlflow/pull/21435nvdIssue TrackingPatchWEB
- afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectorsnvdExploitThird Party AdvisoryWEB
- cert.pl/en/posts/2026/04/CVE-2026-33865/nvdThird Party Advisory
- github.com/advisories/GHSA-fh64-r2vc-xvhrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33865ghsaADVISORY
- cert.pl/en/posts/2026/04/CVE-2026-33865ghsaWEB
- github.com/mlflow/mlflow/commit/aca4dd0ec88a12f7655155c224371280e9b45ddaghsaWEB
News mentions
0No linked articles in our index yet.