A command injection flaw occurs in the mlflow model serving component when the enable_mlserver option is enabled. The framework builds a shell command by directly inserting the model URI into a bash invocation. If the supplied URI contains shell metacharacters such as $() or backticks, the shell will execute them. This defect can allow an attacker to run arbitrary commands on the machine that hosts the mlflow service, potentially elevating privileges if the service runs with higher rights and accesses a directory that attackers can write to.

The vulnerability affects the mlflow open‑source framework, specifically the mlflow/mlflow package. No exact version number is stated, but the description notes that the flaw exists in the latest official release. The issue is tied to deployments that enable the optional mlserver interface.

The CVSS score of 7.8 reflects a high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker who can influence the value of model_uri, for example by uploading or modifying a model file that the serving process reads. Successful exploitation requires that the attacker be able to set or alter the model_uri value; the exploit does not grant arbitrary remote code execution without such influence.