repository icon
netflix / metaflow Project repository

Open Source Platform for developing, scaling and deploying serious ML, AI, and data science systems

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN14 DAYS

FIX

WITHINN/A DAYS

Test title minimal
pimpollo2
self closed
Remote code execution via unsafe pickle deserialization of datastore artifacts i...
lewiswigmore
self closed
Metaflow code package extraction allows path traversal
ckeplinger199
duplicate
Medium
Tar Slip in metaflow code package extraction enables cross-user RCE
mverbaan
self closed
Path Traversal in TarPackagingBackend.cls_extract_members() via crafted code pac...
kartikganesh
duplicate
High
Path traversal in Metaflow code package extraction allows arbitrary file write o...
frafra077
duplicate
Medium
Tarball Path Traversal in Code Package Extraction
snakeyworm
duplicate
None
Pickle RCE via Artifact Poisoning in Metaflow
snakeyworm
duplicate
None
Arbitrary file write via unsafe tarfile.extractall in code package extraction —...
snakeyworm
duplicate
None
Path traversal bypass in tar_safe_extract via os.path.commonprefix character-lev...
snakeyworm
duplicate
High
Tarfile path traversal in code package extraction allows arbitrary file write vi...
eistee82
duplicate
High
Path Traversal via os.path.commonprefix Bypass in tar_safe_extract Allows Arbitr...
skyflocka
duplicate
High
Path Traversal via Unsafe tar.extractall() in Code Package Extraction
tranhoangtu-it
duplicate
Medium
Path Traversal via Unsafe Tar Extraction in Code Package Handling (CWE-22)
snailsploit
duplicate
Medium
Unsafe pickle.loads() in Metaflow Task Artifact Deserialization Enables RCE via...
odysseypro25-project
duplicate
High
Path traversal via flawed commonprefix check in tar_safe_extract and unvalidated...
elucidator-hky
duplicate
High
Arbitrary code execution via unsafe pickle.loads() in Metaflow artifact loading...
elucidator-hky
self closed
Code Injection via Unsanitized Argo Workflow Annotations in Fake Flow File Gener...
hiyokosauna37
pending
[CWE-502] Unrestricted Pickle Deserialization in Artifact Loading Enables RCE vi...
shima-coder
duplicate
Critical
Unsafe pickle deserialization in Metaflow task datastore and multicore utilities
etwithin
duplicate
None
Unsafe deserialization via pickle in Metaflow data artifact loading
etwithin
pending
[CWE-22] Tar Path Traversal (Zip Slip) in archive extraction — extractall() with...
shima-coder
duplicate
High
[CWE-78] OS Command Injection via unsanitized parameter values in shell script g...
shima-coder
pending
Path Traversal in Tar Extraction
mstscmsn
duplicate
Medium
Card Server Binds to All Interfaces Without Authentication Exposing Flow Data
mertsatilmaz
pending
Arbitrary File Write via Tar Path Traversal in Code Package Extraction
wernerina
duplicate
High
Metaflow AWS Sandbox SSRF and API Key Leakage Vulnerability
mia-718ai
pending
ArgoEvent Class SSRF Vulnerability - Attacker-Controlled URL Leads to Server-Sid...
mia-718ai
pending
Unsafe Deserialization in task_datastore.py pickle.loads() leads to Remote Code...
mia-718ai
duplicate
Critical
Remote Code Execution via Pickle Deserialization when loading artifacts in metaf...
yueyuel
duplicate
High
Unsafe YAML Deserialization via User-Controlled Loader Allows Arbitrary Code Exe...
evertrustai
pending
Metaflow Arbitrary Code Execution via config_expr() eval() Injection
playeriunknown
pending
Unsafe Deserialization in Metaflow Artifact Storage Allows Remote Code Execution
hyperps1
duplicate
Critical
## METAFLOW CLICK PAGER COMMAND INJECTION (CVE-PENDING)
7908837174
pending
Path Traversal via symlink
ready-research
duplicate
Critical
Path traversal, lead to remote code execution
makerdd
pending
Arbitrary-code execution via insecure pickle deserialization in multicore_utils....
cybersharmaji
pending
Remote Code Execution via Insecure Deserialization in Metaflow Task Artifacts
jplopezy
pending
#Command Injection via Unsafe Use of os.system() in _termui_impl.py
captain-n3m0
pending
Insecure Temporary File in termui_impl.py
ralph13
duplicate
Medium
Insecure Temporary File
fatmo666
duplicate
Medium
Insecure Temporary File
h2oa
not applicable
OS command injection in metaflow.plugins.pypi.micromamba
thevietronin
informative
High
Source repository compromise via GitHub actions workflow
arunstar
informative
Critical
Insecure Temporary File
nhienit2010
informative
High
huntr: netflix/metaflow