clearml vulnerabilities
CVEs whose affected-version data names the clearml package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2025-8917Medium· 5.8A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function
A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory,…
▾ Sunlitclearml · clearmlEPSS 0.48%via NVD
CVE-2024-24591High· 8.8Allegro AI ClearML path traversal vulnerability
Allegro AI ClearML path traversal vulnerability
▾ Twilightclearml · clearmlEPSS 0.80%via OSV
CVE-2024-24595Medium· 6.0Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance
Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance
▾ Sunlitclearml · clearmlEPSS 0.26%via OSV
CVE-2024-24590High· 8.8PoCAllegro AI ClearML vulnerable to deserialization of untrusted data
Allegro AI ClearML vulnerable to deserialization of untrusted data
▾ Midnightclearml · clearmlEPSS 2.5%via OSV