PyPI/mlflow CVE-2025-15379: critical 10, EPSS 2.36%
MLflow Command Injection vulnerability
Action: Upgrade mlflow to 3.8.1 or later.
pip install mlflow==3.8.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.8.1 | - |
Fixed versions
| 3.8.1 |
Sources
- osv: PYSEC-2026-423
- https://nvd.nist.gov/vuln/detail/CVE-2025-15379
- https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05e
- https://github.com/mlflow/mlflow/commit/a22ce7157f646bdce4c95106fc38ccc9ca289205
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75
- https://pypi.org/project/mlflow
- https://github.com/advisories/GHSA-r23q-823p-vmf7
CVE-2025-15379 · published · modified · JSON