•
GHSA-gqvg-gmmx-x4hm: mlflow.statsmodels ignored MLFLOW_ALLOW_PICKLE_DESERIALIZATION before 3.15.0 — crafted artifacts via load_model could RCE even when env=False. Defense: upgrade ≥3.15 (prefer 3.16+), no untrusted artifacts, restrict store writes. Not investment advice.
If you load MLflow models after work — especially anything that may resolve to the mlflow.statsmodels flavor — treat GHSA-gqvg-gmmx-x4hm as an ops hygiene ticket. Public write-ups (Snyk SNYK-PYTHON-MLFLOW-19500672, fix PR #24686) describe a safety-control bypass: before 3.15.0, the statsmodels flavor did not honor MLFLOW_ALLOW_PICKLE_DESERIALIZATION, so loading a crafted model artifact via load_model / mlflow.pyfunc.load_model could lead to remote code execution even when operators believed the env control was False. Affected range commonly cited: ≥ 2.1.0, < 3.15.0. This post is defense only.
The only course CTA is Introduction to Python Programming.
1. Upgrade MLflow to ≥ 3.15.0 — prefer the latest 3.16+ line when available (PyPI current at Hub check: 3.16.0).
python -c "import importlib.metadata as m; print(m.version('mlflow'))" 2>/dev/null || pip show mlflow | sed -n '1,3p'
pip install -U "mlflow>=3.15.0"
2. Do not load untrusted model artifacts. Treat unknown MLmodel trees / shared artifact URIs as hostile until proven otherwise.
3. Restrict artifact-store write access. Only trusted identities should be able to place models where your training or serving process will load them.
4. Keep MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False as policy — and still upgrade. Setting the env var alone did not protect the pre-3.15 statsmodels path; the flag is necessary hygiene, not a substitute for the patched package.
| Situation | Safer default |
|---|---|
| Personal laptop tracking | Upgrade MLflow; load only artifacts you wrote |
| Shared artifact store | Lock down writes; upgrade every consumer to ≥ 3.15 |
| Unknown shared model URI | Do not load_model until provenance is clear |
Check mlflow version and upgrade if below 3.15. If Python packaging is the blocker, Introduction to Python Programming.