CVE-2025-15379: MLflow command injection in model serving dependency installation

Summary

A command injection flaw in MLflow's model serving container initialization, in the `_install_model_dependencies_to_env()` function, affects version 3.8.0. When a model is deployed with `env_manager=LOCAL`, dependency specifications read from the artifact's `python_env.yaml` are interpolated into a shell command without sanitization. An attacker who supplies a malicious model artifact can achieve arbitrary command execution on systems that deploy it.

Mitigation

Fixed in version 3.8.2.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumTrained to betray: How post-training supply chain attacks hijack coding agentsSimilar attack · Microsoft Security Blog
• MediumHackers stole AI credentials to get $740,000 in free compute; Railway picked up the billSimilar attack · CSO Online
• HighCVE-2026-65820: aeon GitHub Actions workflow exposes tokens to fork pull requestsSimilar attack · NVD/CVE Database
• MediumRewriting less than 10 neurons in an LLM can turn it into a sleeper backdoorSimilar attack · CSO Online
• MediumDetecting sleeper agents hiding in AI model neuronsSimilar attack · Microsoft Security Blog