A critical command injection vulnerability in MLflow allows authenticated local attackers to execute arbitrary code on the host system, posing a significant risk to CI/CD and deployment environments.

The vulnerability exists in the mlflow/sagemaker/__init__.py file, where user-supplied container image names are passed directly into os.system() shell commands without sanitization. An attacker with local access can exploit this by providing a malicious string through the --container parameter of the MLflow CLI.

The ability to execute arbitrary commands on a system running MLflow can lead to full system compromise, data theft, and unauthorized manipulation of machine learning models. Given the CVSS score of 7.5, this high-severity flaw threatens the integrity of CI/CD pipelines and cloud deployment infrastructures, potentially allowing attackers to pivot deeper into the corporate network.

Immediate Action: Update MLflow to version 3.8.0rc0 or later to include the necessary input sanitization fixes.

Proactive Monitoring: Audit logs for the MLflow CLI, specifically monitoring for unusual characters or shell syntax within the --container parameter inputs.

Compensating Controls: Restrict access to the MLflow CLI to authorized users only and implement strict input validation at the application layer if an immediate update is not feasible.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Huntr security bounty report.

This vulnerability presents a clear path for arbitrary command execution, which could result in a total compromise of the affected MLflow environment. It is imperative that security teams verify their MLflow deployment versions immediately and apply the 3.8.0rc0 patch to mitigate this risk. Priority should be given to protecting systems used within CI/CD pipelines and cloud-based production environments.