CVE-2025-15379
criticalPriorität · verfolgen · 41EPSS 0.024 · 84. PerzentilEUUSEPSS · bewertet 2026-10-27
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-r23q-823p-vmf7MLflow Command Injection vulnerability2026-03-30ghsa · osvUS
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.1.
- BIT-mlflow-2025-15379Command Injection in mlflow/mlflow2026-04-29vendor · osvUS
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
- PYSEC-2026-423MLflow Command Injection vulnerability2026-06-29vendor · osvUS
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.1.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05ecnnvd
- https://github.com/mlflow/mlflow/releasesPatchcnnvd
- https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75cnnvd
- https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05eenisa_euvd
- https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75enisa_euvd
- https://access.redhat.com/security/cve/CVE-2025-15379Third Party Advisorynvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2452949Third Party Advisorynvd
- https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05ePatchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan