This vulnerability (CVE-2025-14287) in mlflow/mlflow before version 3.7.0 arises from improper control of code generation (CWE-94) and command injection (CWE-78) in the mlflow/sagemaker/__init__.py file at lines 161-167. Specifically, user input for container image names is directly interpolated into shell commands executed with os.system() without sanitization, enabling arbitrary command execution via the CLI's --container parameter. The CVSS 3.0 score is 7.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation allows remote attackers to execute arbitrary commands on affected systems by supplying malicious input to the --container parameter. This can lead to full compromise of the environment running MLflow, affecting confidentiality, integrity, and availability of the system and data. The vulnerability impacts development setups, CI/CD pipelines, and cloud deployments using vulnerable versions of mlflow.

A fix is available in mlflow version 3.7.0 and later. Users should upgrade to version 3.7.0 or newer to remediate this vulnerability. There is no indication from the vendor advisory that the issue is already mitigated or requires no action. Until upgrading, avoid using untrusted input for the --container parameter or restrict access to trusted users only.