What changed
MLflow 3.8.1 patched a flaw where an attacker-controlled model artifact could inject shell commands through python_env.yaml when the model was served with the local environment manager.
Why it matters
Model artifacts can be treated as passive files even though deployment tools interpret environment metadata, creating a software-supply-chain path from registry content to host execution.
What to do
Upgrade to 3.8.1 or later, treat models as executable inputs, restrict who can publish artifacts, inspect recent deployments, and isolate build and serving environments.
Caveat
Exploitation required deployment of attacker-influenced artifacts with the affected environment mode, and the 2025 CVE identifier should not be mistaken for the 2026 disclosure date.