This vulnerability allows an attacker to execute arbitrary shell commands within the MLflow process. It occurs in versions of mlflow before 3.7.0 where the CLI parameter --container is directly inserted into a shell command via os.system without sanitization. The flaw is a classic command injection (CWE‑78, CWE‑94). If exploited, the attacker could compromise confidentiality, integrity, and availability of the system and potentially access sensitive data or disrupt services.

The issue is present in the mlflow/mlflow open‑source project, affecting any deployment that includes the mlflow version earlier than 3.7.0. Users running MLflow in development machines, CI/CD pipelines, or cloud services should verify their installed version and apply updates if necessary. The file mlflow/sagemaker/__init__.py is where the injection occurs, impacting any environment that uses the sagemaker integration and accepts the --container parameter.

The CVSS score of 8.8 indicates high severity, and the EPSS score below 1% suggests low current exploitation probability, though the risk remains significant. The vulnerability is not listed in CISA's KEV catalog. Exploitation would follow an attack path where a privileged user or an attacker with access to the MLflow CLI supplies a malicious value for --container. In environments where the CLI is exposed or accessible by untrusted users, the attack could be performed remotely. Mitigation requires patching or removing the vulnerable code path, as the issue stems from unsanitized user input.