CVE-2025-14287

CVE-2025-14287 is a command injection vulnerability in mlflow/mlflow versions before v3.7.0, located in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The flaw occurs due to the direct interpolation of user-supplied container image names into shell commands without sanitization, followed by execution via `os.system()`. Attackers can exploit this by providing malicious input through the `--container` parameter of the MLflow CLI, impacting environments such as development setups, CI/CD pipelines, and cloud deployments where MLflow is used for machine learning workflows.

The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-94 (Improper Control of Generation of Code). Exploitation requires network access with low complexity and no privileges, but user interaction is needed, such as tricking a legitimate user into running the affected CLI command with a crafted `--container` argument. Successful exploitation enables arbitrary command execution on the host system, potentially leading to high confidentiality, integrity, and availability impacts.

Mitigation involves upgrading to mlflow/mlflow version v3.7.0 or later, where the issue is addressed. Additional details are available in the Huntr advisory at https://huntr.com/bounties/229cd526-41aa-4819-b6f0-e2d0371c89e3.

This vulnerability is particularly relevant to AI/ML practitioners, as MLflow is a widely used open-source platform for managing machine learning lifecycles, and exploitation could compromise sensitive training data or models in affected deployments. No public information on real-world exploitation is available as of the CVE publication on 2026-03-16.