CVE-2025-15379: Command Injection in mlflow/mlflow
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the installmodeldependenciestoenv() function. When deploying a model with envmanager=LOCAL, MLflow reads dependency specifications from the model artifact's pythonenv.yaml file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mlflow/mlflowto a version that resolves this vulnerability.Fixed in 3.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15379?
CVE-2025-15379 has a high severity due to its command injection capability in MLflow.
How do I fix CVE-2025-15379?
To fix CVE-2025-15379, update MLflow to the latest version beyond 3.8.2 where the vulnerability is patched.
What versions of MLflow are affected by CVE-2025-15379?
CVE-2025-15379 affects MLflow versions from 3.8.0 to 3.8.2 inclusive.
What is the impact of CVE-2025-15379?
The impact of CVE-2025-15379 allows attackers to execute arbitrary commands on the server running the vulnerable instance of MLflow.
Is CVE-2025-15379 being actively exploited?
As of now, there are no confirmed reports of active exploitation of CVE-2025-15379, but it remains a high risk.