pypi package report

Is clearml safe?

4 known vulnerabilities, worst severity HIGH.

cvss

8.0

how bad it is if exploited, out of 10

epss

2.5%

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-cpcw-9h9m-wqw9, the advisory selected below

// advisories

GHSA-cpcw-9h9m-wqw9

HIGHCVE-2024-24590

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

Affected: >= 0.17.0, <= 1.14.1
Fixed in: not stated
Weakness: CWE-502
Published: 2024-02-06
Source: github

GHSA NVD MITRE reference

// dependencies

21 direct, 11 carrying known advisories, worst CRITICAL

// ai model usage

No published models are known to use this package.

Checked 2026-09-22 at 01:46 UTC. The most recent advisory here was published 2025-10-05. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is clearml safe? pypi package security report | CyberXYZ