# CVE-2026-33744: BentoML command injection in bentofile.yaml system_packages

Source: https://junglewise.ai/threats/cve-2026-33744-bentoml-command-injection-in-bentofile-yaml-system-packages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-33744 · Severity: high · CVSS 7.8 · Published 2026-03-27

BentoML is a platform for building and deploying machine learning models. A security flaw allows attackers to hide malicious commands inside a project's configuration file (bentofile.yaml). If a user or an automated system builds a container using a compromised configuration, the attacker's commands will execute with high privileges, potentially leading to a full system takeover or data theft.

Technologies: [Bentoml](https://junglewise.ai/threats/technologies/bentoml-bentoml), [bentoml (PyPI)](https://junglewise.ai/threats/technologies/bentoml). Vendors: [BentoML](https://junglewise.ai/threats/vendors/bentoml), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33744 being exploited in the wild.

**How severe is CVE-2026-33744?** High severity, with a CVSS score of 7.8, published 27 March 2026.

**Which products and versions are affected?** bentoml (PyPI) <= 1.4.36, ECOSYSTEM:introduced=0,fixed=1.4.37.

**Is there a fix for CVE-2026-33744?** Yes. bentoml (PyPI): upgrade to 1.4.37 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33744 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-33744?** Check whether you run Bentoml or bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bentoml (PyPI): upgrade to 1.4.37 or later

  ```sh
  pip install "bentoml>=1.4.37"
  ```


## Technical details

A command injection vulnerability exists in BentoML due to the lack of sanitization in the 'docker.system_packages' field within 'bentofile.yaml'. This field is intended for OS package names but is directly interpolated into Dockerfile 'RUN' commands using string formatting or Jinja2 templates. An attacker can provide a crafted package name containing shell metacharacters (e.g., 'curl && id') to achieve arbitrary code execution during the 'bentoml build' or 'bentoml containerize' process. The vulnerability is present in several components, including 'images.py' and 'base_debian.j2'. Users are advised to upgrade to version 1.4.37 or later, which implements proper validation or escaping.

## Affected products

- BentoML BentoML <= 1.4.36

## Identifiers

- CVE-2026-33744
- GHSA-jfjg-vc52-wqvf
- PYSEC-2026-157

## Timeline

- 2026-03-25: disclosed
- 2026-03-26: advisory: GitHub Advisory published
- 2026-03-27: patched: NVD publication and patch availability in 1.4.37

## References

- [https://api.github.com/users/golang-not-rust](https://api.github.com/users/golang-not-rust)
- [https://github.com/golang-not-rust](https://github.com/golang-not-rust)
- [https://api.github.com/users/golang-not-rust/gists%7B/gist_id%7D](https://api.github.com/users/golang-not-rust/gists%7B/gist_id%7D)
- [https://api.github.com/users/golang-not-rust/repos](https://api.github.com/users/golang-not-rust/repos)
- [https://avatars.githubusercontent.com/u/250391218?v=4](https://avatars.githubusercontent.com/u/250391218?v=4)
- [https://api.github.com/users/golang-not-rust/events%7B/privacy%7D](https://api.github.com/users/golang-not-rust/events%7B/privacy%7D)

## Related threats

- [BentoML Dockerfile instruction injection in containerize](https://junglewise.ai/threats/cve-2026-112264-bentoml-through-1-4-39-contains-a-dockerfile-instruction)
- [bentoml OpenLLM command injection in Model Repository Directory Name Handler](https://junglewise.ai/threats/cve-2026-15035-bentoml-openllm-command-injection-in-model-repository-directory)
- [PYSEC-2026-1218 - BentoML has a Path Traversal via Bentofile Configuration](https://junglewise.ai/threats/cve-2026-24123-bentoml-has-a-path-traversal-via-bentofile-configuration)
- [PYSEC-2026-1219 - BentoML Denial of Service (DoS) via Multipart Boundary](https://junglewise.ai/threats/cve-2024-9056-bentoml-denial-of-service-dos-via-multipart-boundary)
- [BentoML command injection in Dockerfile generation via bentofile.yaml](https://junglewise.ai/threats/cve-2026-44346-bentoml-command-injection-in-dockerfile-generation-via-bentofile)