CVE-2025-15379
criticalpriority · track · 41EPSS 0.024 · 84 %ileEUUSEPSS · scored 2026-10-27
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-r23q-823p-vmf7MLflow Command Injection vulnerability2026-03-30ghsa · osvUS
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.1.
- BIT-mlflow-2025-15379Command Injection in mlflow/mlflow2026-04-29vendor · osvUS
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
- PYSEC-2026-423MLflow Command Injection vulnerability2026-06-29vendor · osvUS
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.1.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05ecnnvd
- https://github.com/mlflow/mlflow/releasesPatchcnnvd
- https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75cnnvd
- https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05eenisa_euvd
- https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75enisa_euvd
- https://access.redhat.com/security/cve/CVE-2025-15379Third Party Advisorynvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2452949Third Party Advisorynvd
- https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05ePatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan