BIT-mlflow-2025-15379

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/mlflow/BIT-mlflow-2025-15379.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-mlflow-2025-15379

Aliases

Published

2026-04-29T08:45:22Z

Modified

2026-09-10T16:01:43Z

Summary

Command Injection in mlflow/mlflow

Details

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the _install_model_dependencies_to_env() function. When deploying a model with env_manager=LOCAL, MLflow reads dependency specifications from the model artifact's python_env.yaml file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.

Database specific

{
    "cpes": [
        "cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
}

References

Affected packages

Bitnami / mlflow

Package

Name: mlflow
Purl: pkg:bitnami/mlflow

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

3.8.0

Fixed

3.8.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/mlflow/BIT-mlflow-2025-15379.json"