CVE-2026-33744: BentoML command injection in bentofile.yaml system_packages

CVE-2026-33744 · Severity: high · CVSS 7.8 · Published 2026-03-27

BentoML is a platform for building and deploying machine learning models. A security flaw allows attackers to hide malicious commands inside a project's configuration file (bentofile.yaml). If a user or an automated system builds a container using a compromised configuration, the attacker's commands will execute with high privileges, potentially leading to a full system takeover or data theft.

Technologies: Bentoml, bentoml (PyPI). Vendors: BentoML, PyPI.

Quick answers

Is CVE-2026-33744 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33744 being exploited in the wild.
How severe is CVE-2026-33744?
High severity, with a CVSS score of 7.8, published 27 March 2026.
Which products and versions are affected?
bentoml (PyPI) <= 1.4.36, ECOSYSTEM:introduced=0,fixed=1.4.37.
Is there a fix for CVE-2026-33744?
Yes. bentoml (PyPI): upgrade to 1.4.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33744 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-33744?
Check whether you run Bentoml or bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • bentoml (PyPI): upgrade to 1.4.37 or later
    pip install "bentoml>=1.4.37"

Technical details

A command injection vulnerability exists in BentoML due to the lack of sanitization in the 'docker.system_packages' field within 'bentofile.yaml'. This field is intended for OS package names but is directly interpolated into Dockerfile 'RUN' commands using string formatting or Jinja2 templates. An attacker can provide a crafted package name containing shell metacharacters (e.g., 'curl && id') to achieve arbitrary code execution during the 'bentoml build' or 'bentoml containerize' process. The vulnerability is present in several components, including 'images.py' and 'base_debian.j2'. Users are advised to upgrade to version 1.4.37 or later, which implements proper validation or escaping.

Affected products

  • BentoML BentoML <= 1.4.36

Identifiers

  • CVE-2026-33744
  • GHSA-jfjg-vc52-wqvf
  • PYSEC-2026-157

Timeline

  • 2026-03-25: disclosed
  • 2026-03-26: advisory: GitHub Advisory published
  • 2026-03-27: patched: NVD publication and patch availability in 1.4.37

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.