Command Injection Vulnerability in MLflow Model Serving

CVE-2025-15379

What is CVE-2025-15379?

A command injection vulnerability has been identified in MLflow's model serving container initialization code, specifically within the _install_model_dependencies_to_env() function. The issue arises when deploying a model using env_manager=LOCAL, as MLflow reads dependency specifications from the model artifact's python_env.yaml file and directly embeds them into a shell command without appropriate sanitization. This oversight allows an attacker to introduce a malicious model artifact that can lead to arbitrary command execution on systems utilizing the model, posing significant security risks.

References