CVE-2025-15379: MLflow Command Injection in Model Serving (CVSS 10.0)

Executive Summary

CVE-2025-15379 is a maximum-severity (CVSS 10.0) command injection vulnerability in the MLflow open-source machine learning platform. The flaw resides in the _install_model_dependencies_to_env() function, which is invoked when deploying a model with env_manager=LOCAL. MLflow reads dependency specifications from the model artifact's python_env.yaml file and constructs a shell command to install them — without sanitizing the dependency strings before passing them to the OS.

An attacker who can supply a malicious python_env.yaml (e.g., via a compromised artifact, supply chain attack, or direct artifact upload) can achieve full remote code execution on the MLflow server or deployment target.

CVSS Score: 10.0 (Critical — Maximum)

Vulnerability Overview

Affected Products

Technical Analysis

Root Cause

When deploying an MLflow model with env_manager=LOCAL, the platform calls _install_model_dependencies_to_env() to set up the runtime environment. This function reads the dependencies or build_dependencies fields from the model's python_env.yaml file and constructs a pip install command using those values.

The dependency strings are not sanitized before shell execution. An attacker can inject shell metacharacters — semicolons, backticks, $() substitution, or pipe characters — directly into the dependency specification to execute arbitrary commands.

Vulnerable Code Pattern (Conceptual)

The vulnerability arises when unsanitized user-controlled values from python_env.yaml are passed into a subprocess call that evaluates shell syntax:

# Pseudocode — the vulnerable pattern:
# dep_string = read from python_env.yaml (attacker-controlled)
# subprocess.run(["pip", "install", dep_string], shell=True)  <-- shell=True + unsanitized input

The safe pattern requires:

1. Using shell=False with a list of arguments (never a concatenated string)
2. Validating dependency strings against an allowlist regex before passing to subprocess
3. Using a sandbox or virtualenv with restricted shell access

Malicious python_env.yaml Example

A crafted python_env.yaml designed to exploit this vulnerability would embed shell metacharacters into a dependency specification:

python_version: "3.10"
build_dependencies:
  - pip
dependencies:
  - "numpy; <injected-shell-command>"
  - "requests<shell-substitution-payload>"

When MLflow processes these dependency strings with shell=True, the injected content executes as a shell command on the host.

Attack Scenarios

Scenario 1: Compromised Model Registry

1. Attacker gains write access to MLflow artifact store (misconfigured S3, NFS, etc.)
2. Attacker modifies python_env.yaml in a widely-used model artifact
3. Any deployment with env_manager=LOCAL triggers command injection
4. Full RCE on the deployment server — credentials, environment variables, data exfiltrated

Scenario 2: Supply Chain via Model Hub

1. Attacker publishes a poisoned model to a public or shared model registry
2. Organization downloads and deploys the model with env_manager=LOCAL
3. _install_model_dependencies_to_env() executes attacker's injected commands
4. Complete compromise of the inference or training server

Scenario 3: Insider Threat in Multi-Tenant MLflow

1. Malicious data scientist uploads a model with a crafted python_env.yaml
2. MLOps engineer deploys the model using standard MLflow deployment commands
3. Command injection fires during environment setup — before model validation
4. MLOps server compromised, lateral movement into CI/CD or cloud environment

Scenario 4: CI/CD Pipeline Injection

1. MLflow is part of an automated training and deployment pipeline
2. A compromised training dataset or upstream dependency poisons python_env.yaml
3. Automated deployment triggers command injection without human review
4. Pipeline runner compromise cascades to production infrastructure

Why CVSS 10.0?

The maximum CVSS score reflects every factor being at maximum severity:

• Attack Vector: Network — exploitable over the network
• Privileges Required: None — no authentication needed if artifact store is accessible
• User Interaction: None — no victim action required beyond normal model deployment
• Scope: Changed — impact extends beyond MLflow to the host OS
• All CIA impacts: High — full confidentiality, integrity, and availability compromise

Impact Assessment

Remediation

Priority Action: Patch or Restrict Immediately

# Check your MLflow version
python -c "import mlflow; print(mlflow.__version__)"
 
# Upgrade to the patched version
pip install --upgrade mlflow
 
# Verify upgrade
python -c "import mlflow; print(mlflow.__version__)"

Avoid env_manager=LOCAL for Untrusted Artifacts

# Avoid env_manager=LOCAL when deploying untrusted or externally sourced models
import mlflow.pyfunc
 
# Instead of LOCAL (vulnerable):
# mlflow.pyfunc.serve(model_uri=model_uri, env_manager="local")
 
# Use conda or virtualenv isolation, or container-based deployment:
mlflow.pyfunc.serve(model_uri=model_uri, env_manager="conda")
 
# Or deploy via Docker container for full isolation:
# mlflow models build-docker -m model_uri -n my-model-image

Validate python_env.yaml Before Deployment

import yaml
import re
 
SAFE_PACKAGE_PATTERN = re.compile(r'^[a-zA-Z0-9_\-\.\[\]<>=!,\s]+$')
 
def validate_python_env(python_env_path):
    with open(python_env_path) as f:
        config = yaml.safe_load(f)
 
    for dep in config.get("dependencies", []):
        if not SAFE_PACKAGE_PATTERN.match(str(dep)):
            raise ValueError(f"Suspicious dependency string: {dep}")
 
    for dep in config.get("build_dependencies", []):
        if not SAFE_PACKAGE_PATTERN.match(str(dep)):
            raise ValueError(f"Suspicious build dependency: {dep}")
 
    return True

Container-Based Isolation

# Deploy MLflow models in isolated Docker containers
FROM python:3.10-slim
 
# Non-root user for container execution
RUN useradd -m -u 1000 mlflow
USER mlflow
 
# Limited network access — no outbound during inference
# Network policies enforced at orchestrator level
 
WORKDIR /app
COPY model/ ./model/
RUN pip install mlflow

Detection Indicators

Post-Remediation Checklist

1. Patch all MLflow installations to the version containing the fix
2. Audit python_env.yaml files in all registered model artifacts — check for injected commands
3. Review deployment logs — look for unexpected command execution during recent model deployments
4. Assume breach if env_manager=LOCAL was used with externally sourced models — conduct forensic review
5. Rotate all credentials accessible to the MLflow deployment environment
6. Implement artifact signing — cryptographically verify model artifact integrity before deployment
7. Switch to container deployment — use mlflow models build-docker for isolation
8. Restrict artifact store write access — limit who can upload or modify model artifacts

References

• NVD — CVE-2025-15379
• MLflow GitHub Repository
• OWASP — Command Injection
• Related: CVE-2025-15036 — MLflow Path Traversal in Archive Extraction (CVSS 9.6)