mlx (pypi) has 2 known vulnerabilities, the worst rated MODERATE. Upgrade to 0.29.4 or later to clear all of them. No malicious-package signal is recorded.
71 published AI models are associated with this package: 1 name it in a requirements or pyproject file, 71 load it or import it directly, and 0 are inferred from the runtime stack their declared library pulls in. Only 1 state a version requirement, so this is not a count of affected models.
cvss
5.5
medium
CVSS v4.0 base score out of 10
epss
0.56%
medium
chance of exploitation in 30 days, 47th percentile of all CVEs
xyz score
not scored
CyberXYZ composite out of 10
fig. 01 — GHSA-w6vg-jg77-2qg6, the advisory selected below
CyberXYZ does not call a package safe in absolute terms. It records 2 known vulnerabilities for mlx (pypi), the worst rated MODERATE, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does mlx have known vulnerabilities?
Yes. CyberXYZ records 2 known vulnerabilities for mlx (pypi), the worst rated MODERATE. They are GHSA-w6vg-jg77-2qg6, GHSA-j842-xgm4-wf88.
Which version of mlx should I use?
0.29.4 or later clears every advisory recorded for mlx (pypi). Check the release you pick before installing it.
How do I check mlx before installing?
Search mlx in CyberXYZ Check at https://cyberxyz.io/check?q=mlx. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 13:43 UTC. The most recent advisory here was published 2025-11-21. Updated continuously from NVD, GHSA, OSV and CNA feeds.