| # MLflow CatBoost code shadow RCE PoC | |
| This repository demonstrates that an MLflow CatBoost model can place a Python package named `catboost` in the model-controlled `code/` directory. During `mlflow.catboost.load_model()`, MLflow adds that directory to `sys.path` and then imports `catboost`, executing attacker-controlled model artifact code during model load. | |
| The PoC writes a local marker file only. | |