CVE-2025-15379

Critical · CVSS 9.8

MLflow — Command Injection (CWE-77, CWE-78) via unsanitized shell command interpolation in model serving container initialization

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-77, CWE-78

Description

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.

Search profile — drives PoC discovery

Symbols _install_model_dependencies_to_envenv_manager=LOCALpython_env.yamlmodel serving container initialization

Keywords CVE-2025-15379MLflow command injectionMLflow _install_model_dependencies_to_envMLflow python_env.yaml injectionMLflow env_manager LOCAL RCEMLflow model artifact arbitrary command executionMLflow 3.8.0 vulnerabilityMLflow model serving exploit

Versions: 3.8.0 (fixed in 3.8.2)

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-06-30T18:10:12.581Z