CVE-2024-24590 Allegro AI ClearML vulnerable to deserialization of untrusted data

What is CVE-2024-24590?

CVE-2024-24590 is a high-severity unsafe deserialization vulnerability in Allegro.AI ClearML, published on 6 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

Weakness: CWE-502

Which versions are affected by CVE-2024-24590?

3 open source packages ship an affected version, including clearml. It affects 1 product.

Products include Clear Clearml.

How do I fix CVE-2024-24590?

Upgrade clearml to 1.14.3rc0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2024-24590 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24590 exists.

Public exploit code: 6 proofs of concept on GitHub.

Other vulnerabilities in Allegro.AI ClearML

• CVE-2024-24594 Cross-site scripting in ClearML Critical 9.9
• CVE-2024-24592 Missing authorization in ClearML Critical 9.8
• CVE-2024-24593 Cross-site request forgery in ClearML Critical 9.6
• CVE-2024-24591 Allegro AI ClearML path traversal vulnerability High 8.0
• CVE-2024-24595 Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance Medium 6.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cpcw-9h9m-wqw9, PYSEC-2026-1256.