Advisories for Npm/Mlflow package

When MLflow is deployed with the built-in basic-auth plugin (–app-name basic-auth), any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFORE_REQUEST_HANDLERS map in mlflow/server/auth/init.py, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run – such as POST /api/2.0/mlflow/runs/log-metric – correctly return HTTP 403.

The _validate_source_run and _validate_source_model functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated MLflow user can therefore reference another user's run_id in CreateModelVersion, creating a model version whose artifact URI points at the victim's artifact directory. If the calling user …