Authenticated remote code execution via model deserialization

Unsafe deserialization in the machine learning component of Elastic Elasticsearch allows remote authenticated users to execute code. The component deserializes a crafted trained model artifact and executes attacker-controlled logic with a broader system-call surface than intended. An account authorized to create trained models, upload definitions, and start deployments is required, and clusters without machine learning capacity or with machine learning disabled are unaffected.