CVE-2024-28424

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-14 · updated 2026-06-17
Weakness: CWE-94

Description

zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.

Affected products

zenml-io/zenml: 0.55.4

References

https://github.com/bayuncao/vul-cve-18
https://github.com/bayuncao/vul-cve-18

Get alerted when CVE-2024-28424 or the next vulnerability affects your stack