CVE-2024-2171: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-06-06T19:15Z
Repository: https://github.com/zenml-io/zenml
Language: Markdown
Files changed: README.md, RELEASE_NOTES.md, pyproject.toml, src/zenml/VERSION, src/zenml/zen_server/deploy/helm/Chart.yaml, src/zenml/zen_server/deploy/helm/README.md, src/zenml/zen_stores/migrations/versions/0.56.2_release.py
Commit date: 2024-03-25 21:23:48 +0000
Commit message: Prepare release 0.56.2 (#2564)

* git commit -m 'Prepare release 0.56.2'

* Fix migration issues and introduce new features
Diff: diff --git a/README.md b/README.md
index 338e481a5..d511f6e24 100644
--- a/README.md
+++ b/README.md
@@ -90,11 +90,11 @@
     <a href="https://github.com/issues?q=is%3Aopen+is%3Aissue+archived%3Afalse+user%3Azenml-io+label%3A%22good+first+issue%22">Contribute to Open Source</a>
     ·
     <a href="https://github.com/zenml-io/zenml-projects">Projects Showcase</a>
     <br />
     <br />
-    🎉 Version 0.56.1 is out. Check out the release notes
+    🎉 Version 0.56.2 is out. Check out the release notes
     <a href="https://github.com/zenml-io/zenml/releases">here</a>.
     <br />
     <br />
   </p>
 </div>
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index ca25e3f63..673a1a6ca 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,28 +1,16 @@
 <!-- markdown-link-check-disable -->
-# 0.56.1
+# 0.56.2
 
-This is a patch release aiming to solve a dependency problem which was brought in with the new rate 
-limiting functionality. With 0.56.1 you no longer need `starlette` to run client code or to 
-run ZenML CLI commands.
+This release replaces 0.56.0 and 0.56.1, and fixes the major migration bugs that were in
+that yanked release. Please upgrade directly to 0.56.2 and avoid upgrading to  
+0.56.0 to avoid unexpected migration issues.
 
-## 🥳 Community Contributions 🥳
-
-We'd like to thank @christianversloot for his contribution to this release.
-
-## What's Changed
-* Fix pipelines and model links for the cloud dashboard by @wjayesh in https://github.com/zenml-io/zenml/pull/2554
-* Make starlette non-must for client by @avishniakov in https://github.com/zenml-io/zenml/pull/2553
-* Bump MLFlow to version 2.11.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2552
-
-
-**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.56.0...0.56.1
-
-# 0.56.0
-
-ZenML 0.56.0 introduces a wide array of new features, enhancements, and bug fixes,
-with a strong emphasis on elevating the user experience and streamlining machine
+Note that 0.56.0 and 0.56.1 were removed from PyPI due to an issue with the
+alembic versions + migration which could affect the database state. This release
+fixes that issue.
+This release introduces introduces a wide array of new features, enhancements, and bug fixes, with a strong emphasis on elevating the user experience and streamlining machine
 learning workflows. Most notably, you can now deploy models using Hugging Face inference endpoints thanks for an open-source community contribution of this model deployer stack component!
 
 This release also comes with a breaking change to the services
 architecture.
 
@@ -138,12 +126,11 @@ We'd like to give a special thanks to @dudeperf3ct he contributed to this releas
 by introducing the Huggingface Model Deployer. We'd also like to thank @moesio-f
 for their contribution to this release by adding a new attribute to the `Kaniko` image builder.
 Additionally, we'd like to thank @christianversloot for his contributions to this release.
 
 
-## All changes:
-
+## What's Changed
 * Upgrading SQLModel to the latest version by @bcdurak in https://github.com/zenml-io/zenml/pull/2452
 * Remove KServe integration by @safoinme in https://github.com/zenml-io/zenml/pull/2495
 * Upgrade migration testing with 0.55.5 by @avishniakov in https://github.com/zenml-io/zenml/pull/2501
 * Relax azure, gcfs and s3 dependencies by @strickvl in https://github.com/zenml-io/zenml/pull/2498
 * Use HTTP forwarded headers to detect the real origin of client devices by @stefannica in https://github.com/zenml-io/zenml/pull/2499
@@ -180,16 +167,30 @@ Additionally, we'd like to thank @christianversloot for his contributions to thi
 * Fix integration materializers' URLs in docs by @strickvl in https://github.com/zenml-io/zenml/pull/2538
 * Bug fix HyperAI orchestrator: Offload scheduled pipeline execution to bash script by @christianversloot in https://github.com/zenml-io/zenml/pull/2535
 * Update `pip check` command to use `uv` by @strickvl in https://github.com/zenml-io/zenml/pull/2520
 * Implemented bitbucket webhook event source by @AlexejPenner in https://github.com/zenml-io/zenml/pull/2481
 * Add ZenMLServiceType and update service registration by @safoinme in https://github.com/zenml-io/zenml/pull/2471
+* Prepare release 0.56.0 by @safoinme in https://github.com/zenml-io/zenml/pull/2546
+* Fix formatting and release workflow by @strickvl in https://github.com/zenml-io/zenml/pull/2549
+* Fix release workflow by @strickvl in https://github.com/zenml-io/zenml/pull/2550
+* Fix pipelines and model links for the cloud dashboard by @wjayesh in https://github.com/zenml-io/zenml/pull/2554
+* Make starlette non-must for client by @avishniakov in https://github.com/zenml-io/zenml/pull/2553
+* Bump MLFlow to version 2.11.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2552
+* Prepare release 0.56.1 by @avishniakov in https://github.com/zenml-io/zenml/pull/2555
+* Updated neptune documentation by @SiddhantSadangi in https://github.com/zenml-io/zenml/pull/2548
+* 0.56.0 and 0.56.1 in testing by @avishniakov in https://github.com/zenml-io/zenml/pull/2557
+* Only install uv once by @schustmi in https://github.com/zenml-io/zenml/pull/2558
+* Bump MLFlow to version 2.11.3 by @christianversloot in https://github.com/zenml-io/zenml/pull/2559
+* Update docs with warning about pickle materializer insecurity by @avishniakov in https://github.com/zenml-io/zenml/pull/2561
+* Add service table migration by @safoinme in https://github.com/zenml-io/zenml/pull/2563
 
 ## New Contributors
 * @dudeperf3ct made their first contribution in https://github.com/zenml-io/zenml/pull/2376
 * @moesio-f made their first contribution in https://github.com/zenml-io/zenml/pull/2509
+* @SiddhantSadangi made their first contribution in https://github.com/zenml-io/zenml/pull/2548
 
-**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.55.5...0.56.0
+**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.55.5...0.56.2
 
 # 0.55.5
 
 This patch contains a number of bug fixes and security improvements.
 
diff --git a/pyproject.toml b/pyproject.toml
index 164bc7647..dadc1fe06 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,8 +1,8 @@
 [tool.poetry]
 name = "zenml"
-version = "0.56.1"
+version = "0.56.2"
 packages = [{ include = "zenml", from = "src" }]
 description = "ZenML: Write production-ready ML code."
 authors = ["ZenML GmbH <info@zenml.io>"]
 readme = "README.md"
 homepage = "https://zenml.io"
diff --git a/src/zenml/VERSION b/src/zenml/VERSION
index a4c4386b1..cc169d8ce 100644
--- a/src/zenml/VERSION
+++ b/src/zenml/VERSION
@@ -1 +1 @@
-0.56.1
\ No newline at end of file
+0.56.2
\ No newline at end of file
diff --git a/src/zenml/zen_server/deploy/helm/Chart.yaml b/src/zenml/zen_server/deploy/helm/Chart.yaml
index 3ea33596a..e6bc01d1a 100644
--- a/src/zenml/zen_server/deploy/helm/Chart.yaml
+++ b/src/zenml/zen_server/deploy/helm/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 name: zenml
-version: "0.56.1"
+version: "0.56.2"
 description: Open source MLOps framework for portable production ready ML pipelines
 keywords:
 - mlops
 - zenml
 - server
diff --git a/src/zenml/zen_server/deploy/helm/README.md b/src/zenml/zen_server/deploy/helm/README.md
index 3010ff3fd..0f678b869 100644
--- a/src/zenml/zen_server/deploy/helm/README.md
+++ b/src/zenml/zen_server/deploy/helm/README.md
@@ -18,12 +18,12 @@ ZenML is an open-source MLOps framework designed to help you create robust, main
 ### Install the Chart
 
 To install the ZenML chart directly from Amazon ECR, use the following command:
 
 ```bash
-# example command for version 0.56.1
-helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.56.1
+# example command for version 0.56.2
+helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.56.2
 ```
 
 Note: Ensure you have OCI support enabled in your Helm client and that you are authenticated with Amazon ECR.
 
 ## Configuration
diff --git a/src/zenml/zen_stores/migrations/versions/0.56.2_release.py b/src/zenml/zen_stores/migrations/versions/0.56.2_release.py
new file mode 100644
index 000000000..47431e949
--- /dev/null
+++ b/src/zenml/zen_stores/migrations/versions/0.56.2_release.py
@@ -0,0 +1,23 @@
+"""Release [0.56.2].
+
+Revision ID: 0.56.2
+Revises: 0701da9951a0
+Create Date: 2024-03-25 14:49:49.021147
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "0.56.2"
+down_revision = "0701da9951a0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Upgrade database schema and/or data, creating a new revision."""
+    pass
+
+
+def downgrade() -> None:
+    """Downgrade database schema and/or data back to the previous revision."""
+    pass

Vulnerable code:     🎉 Version 0.56.1 is out. Check out the release notes
# 0.56.1
This is a patch release aiming to solve a dependency problem which was brought in with the new rate 
limiting functionality. With 0.56.1 you no longer need `starlette` to run client code or to 
run ZenML CLI commands.
## 🥳 Community Contributions 🥳

We'd like to thank @christianversloot for his contribution to this release.

## What's Changed
* Fix pipelines and model links for the cloud dashboard by @wjayesh in https://github.com/zenml-io/zenml/pull/2554
* Make starlette non-must for client by @avishniakov in https://github.com/zenml-io/zenml/pull/2553
* Bump MLFlow to version 2.11.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2552


**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.56.0...0.56.1

# 0.56.0

ZenML 0.56.0 introduces a wide array of new features, enhancements, and bug fixes,
with a strong emphasis on elevating the user experience and streamlining machine
## All changes:

**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.55.5...0.56.0
version = "0.56.1"
0.56.1
version: "0.56.1"
# example command for version 0.56.1
helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.56.1
Fixed code:     🎉 Version 0.56.2 is out. Check out the release notes
# 0.56.2
This release replaces 0.56.0 and 0.56.1, and fixes the major migration bugs that were in
that yanked release. Please upgrade directly to 0.56.2 and avoid upgrading to  
0.56.0 to avoid unexpected migration issues.
Note that 0.56.0 and 0.56.1 were removed from PyPI due to an issue with the
alembic versions + migration which could affect the database state. This release
fixes that issue.
This release introduces introduces a wide array of new features, enhancements, and bug fixes, with a strong emphasis on elevating the user experience and streamlining machine
## What's Changed
* Prepare release 0.56.0 by @safoinme in https://github.com/zenml-io/zenml/pull/2546
* Fix formatting and release workflow by @strickvl in https://github.com/zenml-io/zenml/pull/2549
* Fix release workflow by @strickvl in https://github.com/zenml-io/zenml/pull/2550
* Fix pipelines and model links for the cloud dashboard by @wjayesh in https://github.com/zenml-io/zenml/pull/2554
* Make starlette non-must for client by @avishniakov in https://github.com/zenml-io/zenml/pull/2553
* Bump MLFlow to version 2.11.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2552
* Prepare release 0.56.1 by @avishniakov in https://github.com/zenml-io/zenml/pull/2555
* Updated neptune documentation by @SiddhantSadangi in https://github.com/zenml-io/zenml/pull/2548
* 0.56.0 and 0.56.1 in testing by @avishniakov in https://github.com/zenml-io/zenml/pull/2557
* Only install uv once by @schustmi in https://github.com/zenml-io/zenml/pull/2558
* Bump MLFlow to version 2.11.3 by @christianversloot in https://github.com/zenml-io/zenml/pull/2559
* Update docs with warning about pickle materializer insecurity by @avishniakov in https://github.com/zenml-io/zenml/pull/2561
* Add service table migration by @safoinme in https://github.com/zenml-io/zenml/pull/2563
* @SiddhantSadangi made their first contribution in https://github.com/zenml-io/zenml/pull/2548
**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.55.5...0.56.2
version = "0.56.2"
0.56.2
version: "0.56.2"
# example command for version 0.56.2
helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.56.2
"""Release [0.56.2].

Revision ID: 0.56.2
Revises: 0701da9951a0
Create Date: 2024-03-25 14:49:49.021147

"""

# revision identifiers, used by Alembic.
revision = "0.56.2"
down_revision = "0701da9951a0"
branch_labels = None
depends_on = None


def upgrade() -> None:
    """Upgrade database schema and/or data, creating a new revision."""
    pass


def downgrade() -> None:
    """Downgrade database schema and/or data back to the previous revision."""
    pass