Executive brief
BentoML is a platform for building and deploying machine learning models. A security flaw allows attackers to hide malicious commands inside a project's configuration file (bentofile.yaml). If a user or an automated system builds a container using a compromised configuration, the attacker's commands will execute with high privileges, potentially leading to a full system takeover or data theft.
Technical details
A command injection vulnerability exists in BentoML due to the lack of sanitization in the 'docker.system_packages' field within 'bentofile.yaml'. This field is intended for OS package names but is directly interpolated into Dockerfile 'RUN' commands using string formatting or Jinja2 templates. An attacker can provide a crafted package name containing shell metacharacters (e.g., 'curl && id') to achieve arbitrary code execution during the 'bentoml build' or 'bentoml containerize' process. The vulnerability is present in several components, including 'images.py' and 'base_debian.j2'. Users are advised to upgrade to version 1.4.37 or later, which implements proper validation or escaping.
Affected products
- BentoML BentoML <= 1.4.36
Timeline
- 2026-03-25: disclosed
- 2026-03-26: advisory: GitHub Advisory published
- 2026-03-27: patched: NVD publication and patch availability in 1.4.37
References
- https://api.github.com/users/golang-not-rust
- https://github.com/golang-not-rust
- https://api.github.com/users/golang-not-rust/gists%7B/gist_id%7D
- https://api.github.com/users/golang-not-rust/repos
- https://avatars.githubusercontent.com/u/250391218?v=4
- https://api.github.com/users/golang-not-rust/events%7B/privacy%7D