MLflow Command Injection Schwachstelle

The vulnerability stems from MLflow's reliance on the pythonenv.yaml file within the model artifact to specify dependencies. When deploying a model with envmanager=LOCAL, MLflow directly interpolates the contents of this file into a shell command without proper sanitization. An attacker can craft a malicious python_env.yaml file containing shell commands that will be executed with the privileges of the MLflow deployment process. This could allow the attacker to install malware, steal sensitive data, or gain persistent access to the system. The impact is particularly severe as it can be triggered during model deployment, a common and often automated process.

Organizations heavily reliant on MLflow for model deployment, particularly those using the LOCAL environment manager, are at significant risk. This includes data science teams, machine learning engineers, and DevOps professionals responsible for deploying ML models in production environments. Shared hosting environments where multiple users can upload model artifacts are also particularly vulnerable.

• python / mlflow:

import os
import subprocess

def check_python_env_yaml(yaml_file):
    try:
        with open(yaml_file, 'r') as f:
            yaml_content = f.read()
        if '!' in yaml_content:
            print(f"Potential command injection detected in {yaml_file}")
    except FileNotFoundError:
        print(f"File not found: {yaml_file}")

# Example usage
check_python_env_yaml('path/to/python_env.yaml')

• linux / server:

find /opt/mlflow/models -name 'python_env.yaml' -print0 | xargs -0 grep -l '!'

1. 2026-03-30Disclosure

   disclosure

1. Reserviert2025-12-30
2. Veröffentlicht2026-03-30
3. Geändert2026-04-01
4. EPSS aktualisiert2026-04-06

The primary mitigation for CVE-2025-15379 is to upgrade to MLflow version 3.8.1 or later. As an interim measure, carefully review the contents of any model artifacts before deployment, paying close attention to the pythonenv.yaml file. Consider using a container runtime with enhanced security features, such as seccomp profiles or AppArmor, to limit the potential impact of command injection. Implement a Web Application Firewall (WAF) to filter out suspicious commands in the pythonenv.yaml file. After upgrading, confirm the fix by deploying a model with a known malicious python_env.yaml and verifying that the command injection is prevented.