CVE-2025-15379
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
A command injection vulnerability exists in MLflow version 3.8.0 in the model serving container initialization code. The `_install_model_dependencies_to_env()` function directly interpolates dependencies from the `python_env.yaml` file into a shell command without sanitization, allowing an attacker to execute arbitrary commands by supplying a malicious model artifact.
Risk Assessment
An attacker can remotely execute arbitrary commands on the system deploying the model, leading to full server compromise, data theft, or lateral movement within the infrastructure.
Recommendation
Immediately upgrade MLflow to version 3.8.2 or later. Always verify the contents of the `python_env.yaml` file before deploying models from external sources.
Original NVD description (English source)
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.