CVE-2025-15379 - Vulnerability Analysis
CriticalCVSS: 10.0Last Updated: March 30, 2026
MLflow - Command Injection
Published: March 30, 2026Updated: March 30, 2026Remote Exploitable
Overview
MLflow 3.8.0 contains a command injection caused by unsanitized interpolation of python_env.yaml dependencies in _install_model_dependencies_to_env(), letting attackers execute arbitrary commands when deploying models with env_manager=LOCAL.
Severity & Score
Severity: Critical
CVSS Score: 10.0
Impact
Attackers can execute arbitrary commands on systems deploying malicious model artifacts, potentially leading to full system compromise.
Mitigation
Upgrade to version 3.8.2 or later.
References
Related Resources
Details
- CVE ID
- CVE-2025-15379
- Severity
- Critical
- CVSS Score
- 10.0
- Type
- command_injection
- Status
- new
CWE
- CWE-77
CVSS Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H