Executive brief
bentoml OpenLLM is a platform used to run and deploy open-source large language models. A vulnerability exists where a specially crafted model repository can trick the system into executing unauthorized commands on the host machine. This could allow an attacker who provides a malicious model to gain control over the environment where the software is running.
Technical details
A command injection vulnerability exists in bentoml OpenLLM 0.6.30 within the `async_run_command` function in `src/openllm/common.py`. The root cause is the use of `asyncio.create_subprocess_shell` on a command string constructed by joining a list of arguments without proper sanitization. Specifically, the `bentoml_tag` is derived from directory names in a cloned model repository; if these directory names contain shell metacharacters (e.g., semicolons or backticks), they are interpreted by the shell during execution. An attacker can achieve arbitrary code execution on the victim's machine when the victim runs `openllm run` or `openllm serve` against a malicious repository. A pull request has been proposed to switch to `create_subprocess_exec`, which handles arguments as a list and avoids shell evaluation.
Affected products
- bentoml OpenLLM 0.6.30
Timeline
- 2026-06-07: disclosed: Issue reported on GitHub repository
- 2026-07-07: other: Pull request with fix submitted by community member
- 2026-07-08: advisory: CVE published and NVD record created