MLflowGHSA-r23q-823p-vmf7
MLflow Command Injection vulnerability
Critical10.0CVE-2025-15379 · Published Mar 30, 2026 · updated Sep 10, 2026
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.1.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.8.1 | 3.8.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-77
- Also known as
- BIT-mlflow-2025-15379, CVE-2025-15379, PYSEC-2026-423
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 7 | MLflow: cross-site scripting Medium5.4Apr 7 | Medium5.4 | 3.11.1 |
| Apr 7 | MLflow is vulnerable to an authorization bypass affecting the AJAX endpointMedium4.3Apr 7 | Medium4.3 | 3.11.0rc0 |
| Apr 3 | MLflow: remote code executionCritical9.1Apr 3 | Critical9.1 | No fix yet |
| Mar 31 | Mlflow: Command Injection when serving models with enable_mlserver=TrueCritical9.6Mar 31 | Critical9.6 | 3.9.0 |
| Mar 30 | MLFlow path traversal vulnerabilityCritical9.6Mar 30 | Critical9.6 | 3.9.0rc0 |
| Mar 27 | MLFlow allows Tracing + Assessments AccessHigh8.1Mar 27 | High8.1 | No fix yet |