CVE-2025-14287

What it actually does

A command injection vulnerability in MLflow allows an unauthenticated attacker to execute arbitrary shell commands on the host system. The flaw exists because user-supplied input for a container image name via the '--container' CLI parameter is passed directly to a shell command executed by 'os.system()' without proper sanitization. This results in remote code execution with the privileges of the user running the MLflow command.

Why it matters to the business

Exploitation of this vulnerability can lead to a full compromise of systems running MLflow, including developer workstations, CI/CD servers, and cloud environments. This could result in the theft of sensitive data and proprietary machine learning models, disruption of ML development and deployment pipelines, and lateral movement within the network. A successful attack could also lead to a supply chain compromise if CI/CD systems are targeted, allowing an attacker to inject malicious code into production software.

How an attack unfolds

An attacker crafts a malicious payload containing shell commands and embeds it within a string intended for the '--container' parameter of the MLflow CLI. The attacker then uses social engineering tactics, such as providing a malicious command in a public tutorial or a compromised project's documentation, to trick a developer or data scientist into executing the 'mlflow sagemaker' command with the crafted parameter. When the victim runs the command, the vulnerable MLflow code concatenates the malicious string into a system command, which is then executed, giving the attacker code execution on the victim's machine.

How to fix it

To remediate this vulnerability, upgrade MLflow to version 3.7.0 or later. If an immediate upgrade is not possible, implement strict input validation on any values passed to the '--container' parameter in automated scripts and CI/CD pipelines. Additionally, educate users on the dangers of running commands from untrusted sources.

How to confirm the fix worked

To verify the fix, confirm that the installed version of the 'mlflow' package is 3.7.0 or newer by running 'pip show mlflow' or an equivalent package management command. To check for exposure, audit all scripts, CI/CD jobs, and internal documentation for usage of the 'mlflow sagemaker' command. Scrutinize any instances where the '--container' parameter is sourced from a user-controllable or untrusted location.

Typical attack path

1. An attacker crafts a malicious payload containing shell commands, disguised as a container image name.
2. The attacker uses social engineering to convince a user to run an 'mlflow sagemaker' command with the malicious string passed to the '--container' parameter.
3. The user executes the command on a system running a vulnerable version of MLflow.
4. The MLflow application unsafely incorporates the malicious string into a shell command and executes it.
5. The attacker's payload is executed on the system, leading to remote code execution and potential system compromise.

How to detect it

Monitor command-line execution logs on systems where MLflow is installed, such as developer workstations and CI/CD runners. Look for executions of 'mlflow sagemaker' where the value for the '--container' parameter contains shell metacharacters (e.g., ';', '|', '&', '$', '`'). Suspicious child processes spawned by the Python process executing MLflow could also indicate compromise. Correlate these findings with anomalous network activity, such as outbound connections to unknown IP addresses, which may suggest a reverse shell or data exfiltration.

• --container '*;*'
• --container '*|*'
• --container '*&&*'
• --container '*`*'
• --container '*$(*)*'

What your security team should do

• Prioritize upgrading all instances of MLflow to version 3.7.0 or later, starting with internet-facing and CI/CD environments.
• Audit all automation scripts and CI/CD pipelines for use of the 'mlflow sagemaker' command and ensure any input to the '--container' parameter is either static and trusted or strictly validated.
• Advise developers and ML engineers to avoid running commands from untrusted sources and to be cautious of command-line arguments in tutorials or documentation.