New Vulnerabilities Found in Open-Source Machine Learning Systems

Cybersecurity researchers from JFrog have identified multiple security vulnerabilities in popular open-source machine learning frameworks like MLflow, H2O, PyTorch, and MLeap. These flaws, which include issues like cross-site scripting and unsafe deserialization, could allow attackers to execute code remotely and access sensitive information within organizations. The vulnerabilities highlight the risks associated with loading untrusted ML models, even from seemingly safe sources, and underscore the need for caution in handling ML tools to prevent potential exploitation.