| # MLflow TensorFlow custom_objects.cloudpickle RCE |
| |
| This repository contains a proof-of-concept MLflow TensorFlow/Keras model artifact. |
| |
| `mlflow.tensorflow.load_model()` loads `custom_objects.cloudpickle` from the model directory when present. The PoC verifies that deserializing that file executes attacker-controlled Python code during model loading. |
| |
| Run: |
| |
| ```bash |
| python build_and_verify.py |
| ``` |
| |
| Expected result: |
| |
| - `marker_created=true` |
| - `model_loaded_successfully=true` |
| - `mlflow_tensorflow_custom_objects_marker.txt` is created during `mlflow.tensorflow.load_model()` |
|
|
