CVE-2025-15379 is a maximum severity command injection (CVSS 10.0) in MLflow 3.8.0. When a model is deployed with env_manager set to LOCAL, dependency specs from the model artifact reach a shell command unsanitized. The fix is MLflow 3.8.2. Only deploy models you trust until you upgrade.
What's affected
The CVE record says the vulnerability affects MLflow version 3.8.0 and is fixed in version 3.8.2. The vulnerable function is _install_model_dependencies_to_env() in the model serving container initialization code.
The weakness appears when a model is deployed with env_manager=LOCAL. In that mode MLflow reads dependency specifications from the model artifact's python_env.yaml file and builds a shell command from them without cleaning the values.
The upstream fix is commit 361b6f6, titled "fix(security): prevent command injection via malicious model artifacts" (pull request 19583). The record does not mention any other affected release, so check the MLflow release notes if you run a different 3.x build.
How to check if you're exposed
Check which MLflow you have:
pip show mlflow
A result of 3.8.0 is affected. Then check how models are deployed. Search deployment scripts, Dockerfiles and CI jobs for the option:
grep -rn "env_manager" .
grep -rn "LOCAL" --include=*.py --include=*.sh --include=Dockerfile .
Only deployments using the LOCAL environment manager follow the path the record describes. Also review where the model artifacts come from. A model pulled from a shared registry or a third party is the input the flaw needs.
What to do now
- Upgrade MLflow to 3.8.2 or later in every serving image and environment.
- Find deployments that use env_manager LOCAL and decide whether they can use a managed or containerized environment instead.
- Review the registry and artifact stores that feed model serving, and limit who can upload or edit models.
- Treat any model artifact from an untrusted source as code, because its dependency file is executed through a shell.
- Run serving containers with minimal privileges and without cloud credentials mounted, to shrink the blast radius.
Why it matters
The record lists CWE-77, Command Injection, and CWE-78, OS Command Injection. Building a command line by joining strings that came from a file is the classic setup. A package name that carries shell syntax can turn a dependency list into instructions. The safer pattern passes arguments as a list, never through a shell.
The 10.0 score comes from a network vector, no privileges, no interaction and a changed scope. It is not listed in CISA's Known Exploited Vulnerabilities catalog in the record. The practical risk centers on model supply chains: a model artifact looks like data, but here it carries an executable surface.
Judging whether it is exploitable in your setup
A severity score does not know your deployment mode. An exploitability check asks the narrower question: is the vulnerable code reachable, and can an outsider reach the input? The free in-browser dependency scan at https://gold.safeguard.sh/scan checks a manifest against known vulnerabilities without installing anything. The Gold directory pages for each CVE and CWE collect the same facts in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-15379?
MLflow 3.8.2, per the CVE record. The record says the issue affects 3.8.0.
Does this affect every MLflow deployment?
The record describes models deployed with env_manager set to LOCAL. Other deployment modes are not described as vulnerable, but upgrading removes the question.
Sources
Last reviewed: 19 October 2026.
