-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ydata-profiling | pip | >= 3.7.0, <= 4.8.3 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2024-37064 specifically references unsafe deserialization in dataset loading via read_pandas. The HiddenLayer advisory explicitly shows this function handles pickle files using pd.read_pickle(), which executes arbitrary code during deserialization. The code snippet demonstrates direct use of pickle loading for .pkl/.pickle extensions without security checks, making this the clear attack vector.