Search results

Stored XSS in Metaflow cards via unsanitized Markdown component (svelte-markdown / marked sanitize:false, no DOMPurify)

Status: Open.

#3278 In Netflix/metaflow;

· geo-chen opened on Jun 20, 2026

Bug: No way to pass custom credentials/session vars to AWS Secrets Manager provider

Status: Open.

#3275 In Netflix/metaflow;

· mrharpo opened on Jun 17, 2026

Arbitrary Code Execution via Uncontrolled importlib.exec_module() on User-Supplied File Paths

Status: Open.

#3256 In Netflix/metaflow;

· chinhnguyen007 opened on Jun 10, 2026

BUG: OS COMMAND INJECTION TRONG NETFLIX/METAFLOW

Status: Open.

#3255 In Netflix/metaflow;

· chinhnguyen007 opened on Jun 10, 2026

Remote Code Execution via Unsafe Deserialization in Env-Escape IPC Layer

Status: Open.

#3254 In Netflix/metaflow;

· chinhnguyen007 opened on Jun 10, 2026

ArgoClient.get_workflow_templates swallows a 404, making "list failed" indistinguishable from "no templates"

Status: Open.

#3239 In Netflix/metaflow;

· mcg1969 opened on Jun 6, 2026

Users can specify --run-id for a previously existing run, and Metaflow happily continues

Status: Open.

#3229 In Netflix/metaflow;

· emattia opened on Jun 1, 2026

Incorrect usage of backtick

Status: Open.

#3217 In Netflix/metaflow;

· albert-github opened on May 29, 2026

aws_batch_tags / METAFLOW_BATCH_DEFAULT_TAGS silently ignored unless METAFLOW_BATCH_EMIT_TAGS=true

Status: Open.

#3209 In Netflix/metaflow;

· aspratyush opened on May 21, 2026

@batch step fails locally with 'No IAM role specified' when no per-job IAM role is configured

Status: Open.

#3208 In Netflix/metaflow;

· aspratyush opened on May 21, 2026

Feature request: provide optional install groups for hydrated datastore dependencies

Status: Open.

#3206 In Netflix/metaflow;

· mike-haus opened on May 21, 2026

[Security] Vulnerability Disclosure — 4 findings (RCE, Command Injection, SSRF, Missing Authorization)

Status: Open.

#3202 In Netflix/metaflow;

· NagiSheshero7 opened on May 15, 2026