AI agent vulnerability · MLflow

CVE-2025-14287: MLflow has a command injection in mlflow/sagemaker/init.py

highCVSS 3.0 7.5GHSA-xch3-2f9x-wh9f

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using os.system().

Published Mar 16, 2026 · Updated Mar 17, 2026

Affected packages

mlflow

Ecosystem: PyPI
Affected: < 3.8.0rc0
Fixed in: 3.8.0rc0
Check: pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/__init__.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using os.system(). This allows attackers to execute arbitrary commands by supplying malicious input through the --container parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries