Threats tagged 'bit-mlflow-2025-14287'

A command injection vulnerability exists in mlflow versions prior to 3.7.0 in the mlflow/sagemaker/__init__.py file. The flaw allows attackers to execute arbitrary commands by supplying malicious input through the --container parameter of the CLI, due to unsanitized interpolation of user input into shell commands executed via os.system(). This affects environments using MLflow, including development, CI/CD pipelines, and cloud deployments. The vulnerability is rated high severity and a patch is available.