logo

Database

Server side template injection In mlflow

Description

Jinja2 template injection in mlflow Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-67092. NVD-2023-67093. OSV-2023-67094. GCVE-2023-6709

References

1. https://github.com/mlflow/mlflow/commit/432b8ccf27fd3a76df4ba79bb1bec62118a856252. https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-281.yaml3. https://huntr.com/bounties/9e4cc07b-6fff-421b-89bd-9445ef61d34d

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.