Vulnerability CVE-2023-6940
Published: 2023-12-19

Description:
with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system.

Type:

CWE-77

 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))

 References:
https://huntr.com/bounties/c6f59480-ce47-4f78-a3dc-4bd8ca15029c
https://github.com/mlflow/mlflow/commit/5139b1087d686fa52e2b087e09da66aff86297b1
Copyright 2026, cxsecurity.com

 

Back to Top