YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
MLflow DSPy Pickle Deserialization Bypass — PoC
Advisory: GHSA-v26q-23qw-4825 Affected: mlflow <= 3.12.0 with DSPy flavor (use_dspy_model_save=True) Fix PR: mlflow#23293 Severity: High — Arbitrary Code Execution at model load time
Summary
MLflow provides MLFLOW_ALLOW_PICKLE_DESERIALIZATION=false as a security control.
The DSPy flavor loader bypasses this by calling dspy.load(..., allow_pickle=True)
without checking the guard, allowing RCE from malicious model artifacts.
Reproduce
pip install mlflow==3.12.0 dspy==3.2.1 cloudpickle
export MLFLOW_ALLOW_PICKLE_DESERIALIZATION=false
python3 reproduce.py
Expected Output
Exception (AFTER RCE): Loading .pkl files can run arbitrary code... RCE CONFIRMED: MLFLOW_DSPY_RCE_BYPASS_CONFIRMED uid=1000(user) ...
Code executes BEFORE the exception is raised.
Fix
PR #23293 hoists the guard above the branch dispatch so both load paths are protected.