CVE-2024-24590

    Dashboard / Vulnerabilities / CVE-2024-24590

    CVE-2024-24590

    Published: 6 Feb 2024Last Modified: 28 Oct 2026

    Summary:

    Details: Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

    References: https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24590.json, https://nvd.nist.gov/vuln/detail/CVE-2024-24590, https://github.com/allegroai/clearml

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c8e0e6b7407a9801e9029cea94a3ec552fa85a32
    Fixed -0594a5ac8504d090bb851265f4f5c02c8d862dde

    Affected versions

    v1.14.3rc0
    v1.14.2
    v1.14.2rc0
    v1.14.1
    v1.14.0
    v1.14.0rc0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High