Summary
CERT/CC reported that MLflow’s DSPy flavour applies its pickle guard conditionally based on the file extension, while the statsmodels flavour omits the guard. A malicious model artifact can therefore trigger arbitrary remote code execution through mlflow.pyfunc.load_model() even when pickle deserialization is disabled; statsmodels is fixed in version 3.15.0 and DSPy users are advised to avoid the affected flavour until fixed.
Why it matters
Model registries and artifact stores are part of modern software delivery, so bypassable deserialization controls can turn ordinary model loading into a supply-chain execution path.
Related coverage
- Deno 2.9.7 tightens network, cache and lockfile safety
- Claude Code 2.1.274 hardens MCP startup, session recovery and telemetry
- Cline 4.1.19 blocks planted executables and fixes context exhaustion