CVE-2026-0596
Description
A command injection vulnerability exists in mlflow/mlflow when serving a model with enable_mlserver=True. The model_uri is embedded directly into a shell command executed via bash -c without proper sanitization. If the model_uri contains shell metacharacters, such as $() or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mflowPyPI | < 3.9.0 | 3.9.0 |
Affected products
1- cpe:2.3:a:lfprojects:mlflow:-:*:*:*:*:*:*:*
Patches
1202fac4c83ccFix Command Injection in model serving (#19738)
1 file changed · +2 −1
mlflow/pyfunc/mlserver.py+2 −1 modified@@ -1,5 +1,6 @@ import logging import os +import shlex _logger = logging.getLogger(__name__) @@ -16,7 +17,7 @@ def get_cmd( model_name: str | None = None, model_version: str | None = None, ) -> tuple[str, dict[str, str]]: - cmd = f"mlserver start {model_uri}" + cmd = f"mlserver start {shlex.quote(model_uri)}" cmd_env = os.environ.copy()
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-rvhj-8chj-8v3cghsaADVISORY
- huntr.com/bounties/2e905add-f9f5-4309-a3db-b17de5981285nvdThird Party AdvisoryExploitWEB
- nvd.nist.gov/vuln/detail/CVE-2026-0596ghsaADVISORY
- github.com/mlflow/mlflow/commit/202fac4c83ccc8544c087c142b80196d0e60695cghsaWEB
- github.com/mlflow/mlflow/pull/19738ghsaWEB
News mentions
0No linked articles in our index yet.