CVE-2025-14287

Summary

MLflow has a command injection in mlflow/sagemaker/__init__.py

Severity

high

EPSS

1.2% (p65)

Also known as

GHSA-xch3-2f9x-wh9f, BIT-mlflow-2025-14287

Published

2026-03-16

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-14287
• https://github.com/mlflow/mlflow/pull/19277
• https://github.com/mlflow/mlflow/commit/8b8792a7034fb33a14b0b31cabcaa9b912d3485f

Related advisories

• CVE-2026-2611 — critical · PyPI/mlflow
• CVE-2026-0545 — critical · PyPI/mlflow
• CVE-2026-0596 — critical · PyPI/mlflow
• CVE-2025-15379 — critical · PyPI/mlflow
• CVE-2025-15036 — critical · PyPI/mlflow
• CVE-2026-2635 — critical · PyPI/mlflow
• CVE-2026-4137 — high · PyPI/mlflow
• CVE-2026-2652 — high · PyPI/mlflow

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity