pypi package report

Is mlrun safe?

mlrun (pypi) has 1 known vulnerability, the worst rated LOW. No malicious-package signal is recorded.

// reach

86 direct dependencies

32 carry known advisories, worst CRITICAL

1 packages depend on it

an advisory here reaches each of them

kedro-datasets

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

No published models are known to use this package.

cvss

3.6

low

CVSS v3.1 base score out of 10

epss

0.07%

low

chance of exploitation in 30 days, 0th percentile of all CVEs

xyz score

1.1

low

CyberXYZ composite out of 10

fig. 01 — GHSA-phx2-3w66-h4pw, the advisory selected below

// 1 advisories

GHSA-phx2-3w66-h4pw

LOWGitHub ratingCVE-2026-10766

A vulnerability has been found in mlrun up to 1.12.0-rc3.

Full advisory text at GitHub advisory or NVD.

// cvss v3.1 vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack vector: Local
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: Low

// questions

Is mlrun safe to install?

CyberXYZ does not call a package safe in absolute terms. It records 1 known vulnerability for mlrun (pypi), the worst rated LOW, and no malicious-package signal. Whether it is acceptable depends on the version you run.

Does mlrun have known vulnerabilities?

Yes. CyberXYZ records 1 known vulnerability for mlrun (pypi), the worst rated LOW. They are GHSA-phx2-3w66-h4pw.

How do I check mlrun before installing?

Search mlrun in CyberXYZ Check at https://cyberxyz.io/check?q=mlrun. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.

Checked 2026-11-14 at 11:56 UTC. The most recent advisory here was published 2026-06-03. Updated continuously from NVD, GHSA, OSV and CNA feeds.