Vendor

ml.combust.mleap vulnerabilities

1 published CVE affecting ml.combust.mleap, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 1
High: 0
Medium: 0
Low: 0
Unscored: 0
CISA KEV: 0

Atom feed of ml.combust.mleap alerts

Products

ml.combust.mleap/mleap-runtime_2.12 1

Latest ml.combust.mleap CVEs

Newest publication first

CVE-2023-5245 Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.
Published 2023-11-15

CriticalCVSS 9.8 EPSS 1.2%

FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

ml.combust.mleap vulnerabilities

Products

Latest ml.combust.mleap CVEs

CVE-2023-5245 Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.