CVE-2025-14287: MLflow Command Injection Vulnerability in SageMaker Integration
Summary
CVE-2025-14287: MLflow has a command injection in mlflow/sagemaker/init.py. Affects mlflow versions < 3.8.0rc0. Fixed in 3.8.0rc0. How to fix ↓
Also tracked for
- mlflow · Bitnami
The same CVE-2025-14287 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MLflow is an open-source platform designed for managing the machine learning lifecycle, including experimentation, reproducibility, and deployment. It provides tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. The platform is widely used in various environments, including development setups, CI/CD pipelines, and cloud deployments. However, certain versions of MLflow are vulnerable to command injection attacks, particularly in the SageMaker integration module.
Vulnerability Detail
A command injection vulnerability exists in MLflow versions prior to v3.7.0, specifically in the mlflow/sagemaker/init.py file at lines 161-167. This vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization. As a result, attackers can execute arbitrary commands by supplying malicious input through the --container parameter of the CLI. This poses significant risks, as it can lead to unauthorized access, data breaches, and potential system compromise.
How To Fix
Latest published version: 3.17.2 as of 23 Oct 2026
pip install --upgrade "mlflow==3.17.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.0rc0
This is the first release that contains the fix.
pip install --upgrade "mlflow==3.8.0rc0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the --container parameter with untrusted input. Always validate and sanitize any user-supplied data before using it in shell commands to mitigate the risk of command injection.
Conclusion
In summary, the command injection vulnerability in MLflow's SageMaker integration poses significant risks to users of the platform. It is crucial to update to the patched version to mitigate these risks and ensure the security of your applications. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for mlflow →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
MLflow versions prior to v3.7.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized command execution, data breaches, and system compromise.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for mlflow.
