MLflow’s web interface processes user‑supplied MLmodel files described in YAML. An authenticated attacker can embed a malicious script inside such a file. When another user opens the artifact in the UI, the embedded code runs in that user’s browser, enabling session hijacking or unauthorized actions on their behalf. This is a classic Cross‑Site Scripting vulnerability that can compromise confidentiality, integrity and availability for all users who view the artifact.

The vulnerability exists in all released versions of MLflow up to and including 3.10.1. The affected product is the MLflow tooling used to manage model artifacts and serve the web interface.

The CVSS score of 5.1 indicates a moderate severity. Exploitation requires only that the attacker be authenticated to the system so they can upload the malicious artifact, and a second user must subsequently view it in the UI. Because the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the overall threat rating is moderate but still actionable.