# zenml (PyPI) vulnerabilities

13 known vulnerabilities (1 critical, 2 high, 6 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/zenml/

## Advisories (13)

### [CVE-2025-8406](https://cve.now/CVE-2025-8406): Path Traversal in zenml-io/zenml

- Severity: Medium 6.3
- Published: Oct 5, 2025
- Affected: from 0.81.0, fixed in 0.84.2.

### [CVE-2024-9340](https://cve.now/CVE-2024-9340): Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml

- Severity: High 7.5
- Published: Mar 20, 2025
- Affected: fixed in 0.68.0; fixed in 0.68.0.

### [CVE-2024-4311](https://cve.now/CVE-2024-4311): Lack of login attempt rate-limiting in zenml-io/zenml

- Severity: Medium 5.4
- Published: Nov 14, 2024
- Affected: fixed in 0.57.0rc2.

### [CVE-2024-5062](https://cve.now/CVE-2024-5062): Reflected XSS through survey redirect parameter in zenml-io/zenml

- Severity: Medium 5.3
- Published: Jun 30, 2024
- Affected: fixed in 0.58.0; from 0.57.1, fixed in 0.58.0.

### [CVE-2024-4680](https://cve.now/CVE-2024-4680): Insufficient Session Expiration in zenml-io/zenml

- Severity: Low 3.9
- Published: Jun 8, 2024
- Affected: through 0.56.3.

### [CVE-2024-2032](https://cve.now/CVE-2024-2032): Race Condition Vulnerability in zenml-io/zenml

- Severity: Low 3.1
- Published: Jun 6, 2024
- Affected: fixed in 0.55.5; fixed in 0.55.5.

### [CVE-2024-2035](https://cve.now/CVE-2024-2035): Improper Authorization in zenml-io/zenml

- Severity: Medium 6.5
- Published: Jun 6, 2024
- Affected: fixed in 0.56.2; fixed in 0.56.2.

### [CVE-2024-2171](https://cve.now/CVE-2024-2171): Stored XSS in zenml-io/zenml

- Severity: Low 3.4
- Published: Jun 6, 2024
- Affected: fixed in 0.56.2; fixed in 0.56.2.

### [CVE-2024-2213](https://cve.now/CVE-2024-2213): Improper Authentication in zenml-io/zenml

- Severity: Low 3.3
- Published: Jun 6, 2024
- Affected: fixed in 0.56.3; fixed in 0.56.3.

### [CVE-2024-2383](https://cve.now/CVE-2024-2383): Clickjacking Vulnerability in zenml-io/zenml

- Severity: Medium 4.3
- Published: Jun 6, 2024
- Affected: fixed in 0.56.3; fixed in 0.56.3.

### [CVE-2024-2083](https://cve.now/CVE-2024-2083): Directory Traversal in zenml-io/zenml

- Severity: Critical 9.9
- Published: Apr 16, 2024
- Affected: fixed in 0.55.5.

### [CVE-2024-2260](https://cve.now/CVE-2024-2260): Session Fixation Vulnerability in zenml-io/zenml

- Severity: Medium 4.2
- Published: Apr 16, 2024
- Affected: fixed in 0.56.2; fixed in 0.56.2.

### [CVE-2024-25723](https://cve.now/CVE-2024-25723): ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the…

- Severity: High 8.8
- Published: Feb 27, 2024
- Affected: fixed in 0.42.2; from 0.43.0, fixed in 0.43.1; from 0.45.0, fixed in 0.46.7; from 0.44.0, fixed in 0.44.4; fixed in 0.42.2; from 0.43.0, fixed in 0.43.1; from 0.44.0, fixed in 0.44.4; from 0.45.0, fixed in 0.46.7.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/zenml
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.