Executive brief
BentoML is a framework for building and deploying machine learning models. A vulnerability in its cloud deployment component allows an attacker to execute malicious commands on the cloud infrastructure used to build and package these models. This could lead to the theft of sensitive credentials, API keys, or other customer data stored within the build environment.
Technical details
An OS command injection vulnerability exists in `src/bentoml/_internal/cloud/deployment.py` due to improper neutralization of the `system_packages` field in `bentofile.yaml`. The `_build_setup_script` function uses an f-string to join and interpolate these package names directly into a shell command (`apt-get install`) without quoting or sanitization. An attacker can provide a malicious package name containing shell metacharacters (e.g., semicolons) to execute arbitrary commands. This script is subsequently uploaded to and executed on BentoCloud or enterprise Yatai/Kubernetes build nodes during the deployment process. The vulnerability was partially addressed in a previous commit but missed this specific cloud deployment path. A fix is available in version 1.4.38.
Affected products
- BentoML bentoml <= 1.4.37
Timeline
- 2026-03-24: other: Partial fix implemented in commit ce53491
- 2026-04-02: disclosed
- 2026-04-03: advisory
- 2026-04-06: other: NVD publication