CVE-2025-14287Disclosure(lfprojects / mlflow)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allows attackers to execute arbitrary commands by supplying malicious input through the `--container` parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.

lfprojects CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://huntr.com/bounties/229cd526-41aa-4819-b6f0-e2d0371c89e3

Other references

Weakness type (CWE)

CWE-94CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mlflow

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-15); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

lfprojects

Products

mlflow

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-15	2	Disclosure2
2026-04-19	1	Disclosure1

Full discourse3 posts

PulsePatch.io@pulsepatchio173d
Disclosure
A command injection flaw (CVE-2025-14287) affects `MLflow`'s `SageMaker` integration, allowing for arbitrary command execution. Assess `MLflow` deployments and monitor for patches. #MLflow #CommandInjection #Infosec https://www.pulsepatch.io/posts/cve-2025-14287-mlflow-command-injection
Post summary
CVE-2025-14287 is a command injection flaw in MLflow’s SageMaker integration, enabling arbitrary command execution; users are advised to assess deployments and watch for vendor patches.
00000405
12 followersView on X
CVE@CVEnew207d
Disclosure
CVE-2025-14287 A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulner… https://www.cve.org/CVERecord?id=CVE-2025-14287
Post summary
The post discloses a command injection flaw in mlflow/mlflow prior to version 3.7.0, pinpointing the exact file and line range where the vulnerability resides, but it provides no PoC, exploit code, or mitigation details.
00000160
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash207d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2025-14287 - Command Injection in mlflow/mlflow Intel Report: https://ift.tt/H2qFEio
Post summary
The alert announces CVE-2025-14287, a command injection vulnerability in mlflow, citing an Intel Report. No information on exploit code, active attacks, or patch is provided.
00000145
336 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	lfprojects	mlflow	-	-	-

Explore more

Back to dashboard lfprojects CVEs mlflow vulnerabilities