ZeroDay Findings
Sign inSign up

Findings

CVE-2025-14287

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the file at lines 161-167.

Published Mar 16, 2026 · updated Jul 15, 2026 · lfprojects mlflow

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using . This allows attackers to execute arbitrary commands by supplying malicious input through the parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 16, 2026 · NIST NVD

    Detected

    A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using . This allows attackers to execute arbitrary commands by supplying malicious input through the paramet

  2. Jul 15, 2026 · NIST NVD

    Updated

    A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using . This allows attackers to execute arbitrary commands by supplying malicious input through the paramet

Affected

  • cpe lfprojects/mlflowversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-14287

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2025-14287

    A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without pr

    nvd.nist.gov

References