README.md

MLflow TensorFlow custom_objects.cloudpickle RCE

This repository contains a proof-of-concept MLflow TensorFlow/Keras model artifact.

mlflow.tensorflow.load_model() loads custom_objects.cloudpickle from the model directory when present. The PoC verifies that deserializing that file executes attacker-controlled Python code during model loading.

Run:

python build_and_verify.py

Expected result:

• marker_created=true
• model_loaded_successfully=true
• mlflow_tensorflow_custom_objects_marker.txt is created during mlflow.tensorflow.load_model()