mlflow/mLflow will embed the supplied model_uri directly into a bash command executed via bash -c when the enable_mlserver option is enabled. Because the input is never sanitized, model_uri values that contain shell metacharacters such as $() or backticks trigger command substitution and allow an attacker to run arbitrary shell code. The vulnerability can lead to complete loss of confidentiality, integrity, and availability of the system, and if the application runs with elevated privileges and serves models from a directory writable by lower‑privileged users, it can result in privilege escalation.

The issue is present in the latest version of mlflow/mLflow. The affected vendor is mlflow and the product is mlflow. No specific version range is provided, so all builds after the introduction of enable_mlserver are potentially impacted.

With a CVSS score of 9.6, the vulnerability is considered critical. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can influence the model_uri parameter, such as through the API, can execute arbitrary shell commands. The attack vector is remote, and the potential impact includes arbitrary code execution and elevation of process privileges.