Command Injection Vulnerability in MLflow by Databricks

CVE-2025-14287

What is CVE-2025-14287?

A command injection vulnerability exists in MLflow due to the insecure handling of user-supplied container image names within shell commands. This vulnerability can be exploited when attackers provide malicious input through the --container parameter in the CLI, resulting in arbitrary command execution. The issue is particularly critical in environments such as development environments, CI/CD pipelines, and cloud deployments where MLflow is utilized, as it can lead to unauthorized access and control over the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References