GitHub Advisoryadvisory · PyPI

GHSA-4x5p-f36r-mxxr mlflow Creates of Temporary File in Directory with Insecure Permissions

HIGH Published 2026-02-02 Modified 2026-02-02 Official page ↗
Aliases
CVE-2025-10279
Ecosystem
PyPI
Packages
mlflow
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-379
Reviewed
2026-02-02

Affected packages

• PyPI mlflow: < 3.4.0rc0 → fixed in 3.4.0rc0

Description

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

Related

Alias · CVE (1)

  • CVE-2025-10279 In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable… vulnerability

Weakness · CWE (1)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness

References