EUVD-2025-208671
GHSA-xch3-2f9x-wh9f
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 7.5 indicates high severity with potential for full system compromise (C:H/I:H/A:H), the actual exploitation risk appears moderate. The attack vector requires network access (AV:N) with high complexity (AC:H) and user interaction (UI:R), meaning successful exploitation isn't straightforward. No EPSS data is available to gauge real-world exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known active exploitation. The lack of public POC code and the requirement for specific MLflow SageMaker deployment scenarios further limits the practical attack surface. This appears to be a high-CVSS-but-moderate-real-risk issue. |
| Exploit ScenarioDerived | An attacker with access to an MLflow deployment interface could craft a malicious container image name containing shell metacharacters (e.g., '; malicious_command #') and supply it via the --container parameter when deploying a model to SageMaker. When MLflow processes this input without sanitization and passes it to os.system(), the injected commands would execute with the privileges of the MLflow process. The high attack complexity and user interaction requirements suggest this would most likely be exploited by malicious insiders or through compromised developer accounts rather than external attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Command injection vulnerability in MLflow versions before v3.7.0 that allows attackers to execute arbitrary commands by injecting malicious input through the --container parameter when deploying models to SageMaker. The vulnerability affects MLflow installations in development environments, CI/CD pipelines, and cloud deployments, with a CVSS score of 7.5 indicating high severity. No active exploitation or KEV listing is reported, and no EPSS data is available to assess real-world exploitation likelihood.
RemediationAI
Upgrade to MLflow version 3.7.0 or later which contains the fix for this vulnerability. No specific vendor advisory is linked in the references beyond the HuntrAI bounty report. As a workaround, organizations should validate and sanitize any user-supplied container image names before passing them to MLflow's SageMaker deployment functions, or restrict access to the MLflow SageMaker deployment functionality to trusted users only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the mlflow/sagemaker/__init__.py file where user-supplied container image names are directly interpolated into shell commands and executed via os.system() without proper sanitization. Based on the CPE identifier (cpe:2.3:a:mlflow:mlflow/mlflow:*:*:*:*:*:*:*:*), all MLflow versions prior to v3.7.0 are affected. This is classified as CWE-94 (Improper Control of Generation of Code), a dangerous weakness class that allows attackers to inject and execute arbitrary code through unsanitized input that gets interpreted as code rather than data.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/__init__.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using os.system(). This allows attackers to execute arbitrary commands by supplying malicious input through the --container parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.
Executive ViewAI
A critical command injection vulnerability in MLflow versions before 3.7.0 allows attackers to execute arbitrary commands through the CLI, potentially compromising systems running MLflow across development, CI/CD, and cloud environments. Organizations using affected versions face immediate risk of unauthorized access, data exfiltration, and lateral movement within their infrastructure.
Until patch availability: (1) Restrict MLflow CLI access to authorized personnel only via role-based access controls; (2) Disable the MLflow SageMaker integration if not required for operations; (3) Implement network segmentation to limit MLflow component communication; (4) Monitor and log all MLflow CLI invocations, particularly --container parameter usage; (5) Run MLflow services with minimal required privileges to limit command execution scope; (6) Add input validation rules at the application level to reject shell metacharacters in container image names.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Exploit-DB