MLflow’s model serving initialization performs shell command construction by reading dependency lists from a model artifact’s python_env.yaml file without sanitization. This creates a command injection flaw that allows attackers to include malicious text in the yaml and cause the MLflow service to execute arbitrary shell commands. The weakness is classified as OS Command Injection (CWE-77) and Command Injection (CWE-78), and can compromise the host on which the model is served, enabling attackers to gain full control of the machine.

Version 3.8.0 of the open-source MLflow project (mlflow:mlflow/mlflow) is affected. The fix was introduced in version 3.8.2. The issue arises when a model is deployed with the default LOCAL environment manager and does not involve other external packages.

An attacker can exploit this by uploading a crafted python_env.yaml in a model artifact and deploying it to a server running MLflow with the local environment manager. Because the payload runs in the same shell context as the MLflow service, the attack only requires permission to upload a model artifact. The CVSS v3.1 base score of 9.8 signals complete privilege escalation, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but that does not change the severity of the flaw.