CVE-2025-10279

Affected versions of the mlflow package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the creation of a temporary directory with world-writable permissions. The mlflow/utils/file_utils.py get_or_create_tmp_dir() helper creates a directory via tempfile.mkdtemp() and then changes its mode to 0o777, which mlflow uses as the temporary working location for creating Python virtual environments and enables a race condition where files in that environment can be replaced.