CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2024-24590
High (8.8) in clear clearml. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in clearml 1.14.3rc0.
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.
Severity
- EPSS
- 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- clear:clearml
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cpcw-9h9m-wqw9 | PyPI | clearml | >=0.17.0 <=1.14.1 | no fix published |
| PYSEC-2026-1256 | PyPI | clearml | >=0.17.0 <1.14.3rc0 | 1.14.3rc0 |