Riskcovery

CVE-2025-15379

Command Injection in mlflow/mlflow

State
Published
Severity
10.0 Critical
Published
Mar 30, 2026
Updated
Sep 7, 2026
Reserved
Dec 30, 2025

Read the record on cve.org

Description

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.

Scores

CVSSScoreVectorSource
3.010.0 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H@huntr_ai
3.19.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
mlflow/mlflowmlflow
  • before 3.8.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.