This vulnerability in mlflow/mlflow involves improper neutralization of special elements used in an OS command (CWE-78). Specifically, when serving a model with enable_mlserver=True, the model_uri is passed unsanitized into a bash -c shell command. If the model_uri contains shell metacharacters such as $() or backticks, it enables command substitution and arbitrary command execution. The vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation under certain conditions. The CVSS 3.0 base score is 9.6, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary commands on the host running mlflow/mlflow with the privileges of the service. This can lead to complete system compromise, including privilege escalation if the service runs with elevated rights and serves models from directories writable by lower-privileged users. The impact includes full loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling enable_mlserver=True or ensure that model_uri inputs are strictly validated and sanitized to prevent shell metacharacter injection. Additionally, run the mlflow service with least privilege and avoid serving models from directories writable by untrusted or lower-privileged users.