EUVD-2025-208671
GHSA-xch3-2f9x-wh9f
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allows attackers to execute arbitrary commands by supplying malicious input through the `--container` parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.
Analysis
Command injection vulnerability in MLflow versions before v3.7.0 that allows attackers to execute arbitrary commands by injecting malicious input through the --container parameter when deploying models to SageMaker. The vulnerability affects MLflow installations in development environments, CI/CD pipelines, and cloud deployments, with a CVSS score of 7.5 indicating high severity. No active exploitation or KEV listing is reported, and no EPSS data is available to assess real-world exploitation likelihood.
Technical Context
The vulnerability exists in the mlflow/sagemaker/__init__.py file where user-supplied container image names are directly interpolated into shell commands and executed via os.system() without proper sanitization. Based on the CPE identifier (cpe:2.3:a:mlflow:mlflow/mlflow:*:*:*:*:*:*:*:*), all MLflow versions prior to v3.7.0 are affected. This is classified as CWE-94 (Improper Control of Generation of Code), a dangerous weakness class that allows attackers to inject and execute arbitrary code through unsanitized input that gets interpreted as code rather than data.
Affected Products
All versions of MLflow prior to v3.7.0 are affected, specifically installations that use the SageMaker deployment functionality. The EUVD lists affected versions as 'mlflow/mlflow unspecified ≤latest', confirming all versions up to the patch release are vulnerable. The vulnerability impacts MLflow deployments in development environments, CI/CD pipelines, and cloud deployments where the SageMaker integration is utilized.
Remediation
Upgrade to MLflow version 3.7.0 or later which contains the fix for this vulnerability. No specific vendor advisory is linked in the references beyond the HuntrAI bounty report. As a workaround, organizations should validate and sanitize any user-supplied container image names before passing them to MLflow's SageMaker deployment functions, or restrict access to the MLflow SageMaker deployment functionality to trusted users only.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today