# CVE-2026-35043: BentoML command injection in cloud deployment setup script

Source: https://junglewise.ai/threats/cve-2026-35043-bentoml-command-injection-in-cloud-deployment-setup-script  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-35043 · Severity: high · CVSS 7.8 · Published 2026-04-06

BentoML is a framework for building and deploying machine learning models. A vulnerability in its cloud deployment component allows an attacker to execute malicious commands on the cloud infrastructure used to build and package these models. This could lead to the theft of sensitive credentials, API keys, or other customer data stored within the build environment.

Technologies: [Bentoml](https://junglewise.ai/threats/technologies/bentoml-bentoml), [bentoml (PyPI)](https://junglewise.ai/threats/technologies/bentoml). Vendors: [BentoML](https://junglewise.ai/threats/vendors/bentoml), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-35043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35043 being exploited in the wild.

**How severe is CVE-2026-35043?** High severity, with a CVSS score of 7.8, published 6 April 2026.

**Which products and versions are affected?** bentoml (PyPI) <= 1.4.37, ECOSYSTEM:introduced=0,fixed=1.4.38.

**Is there a fix for CVE-2026-35043?** Yes. bentoml (PyPI): upgrade to 1.4.38 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35043 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-35043?** Check whether you run Bentoml or bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bentoml (PyPI): upgrade to 1.4.38 or later

  ```sh
  pip install "bentoml>=1.4.38"
  ```


## Technical details

An OS command injection vulnerability exists in `src/bentoml/_internal/cloud/deployment.py` due to improper neutralization of the `system_packages` field in `bentofile.yaml`. The `_build_setup_script` function uses an f-string to join and interpolate these package names directly into a shell command (`apt-get install`) without quoting or sanitization. An attacker can provide a malicious package name containing shell metacharacters (e.g., semicolons) to execute arbitrary commands. This script is subsequently uploaded to and executed on BentoCloud or enterprise Yatai/Kubernetes build nodes during the deployment process. The vulnerability was partially addressed in a previous commit but missed this specific cloud deployment path. A fix is available in version 1.4.38.

## Affected products

- BentoML bentoml <= 1.4.37

## Identifiers

- CVE-2026-35043
- GHSA-fgv4-6jr3-jgfw
- PYSEC-2026-158

## Timeline

- 2026-03-24: other: Partial fix implemented in commit ce53491
- 2026-04-02: disclosed
- 2026-04-03: advisory
- 2026-04-06: other: NVD publication

## References

- [https://api.github.com/users/kodareef5](https://api.github.com/users/kodareef5)
- [https://github.com/kodareef5](https://github.com/kodareef5)
- [https://api.github.com/users/kodareef5/gists%7B/gist_id%7D](https://api.github.com/users/kodareef5/gists%7B/gist_id%7D)
- [https://api.github.com/users/kodareef5/repos](https://api.github.com/users/kodareef5/repos)
- [https://avatars.githubusercontent.com/u/261977334?v=4](https://avatars.githubusercontent.com/u/261977334?v=4)
- [https://api.github.com/users/kodareef5/events%7B/privacy%7D](https://api.github.com/users/kodareef5/events%7B/privacy%7D)

## Related threats

- [BentoML Dockerfile instruction injection in containerize](https://junglewise.ai/threats/cve-2026-112264-bentoml-through-1-4-39-contains-a-dockerfile-instruction)
- [bentoml OpenLLM command injection in Model Repository Directory Name Handler](https://junglewise.ai/threats/cve-2026-15035-bentoml-openllm-command-injection-in-model-repository-directory)
- [PYSEC-2026-1218 - BentoML has a Path Traversal via Bentofile Configuration](https://junglewise.ai/threats/cve-2026-24123-bentoml-has-a-path-traversal-via-bentofile-configuration)
- [PYSEC-2026-1219 - BentoML Denial of Service (DoS) via Multipart Boundary](https://junglewise.ai/threats/cve-2024-9056-bentoml-denial-of-service-dos-via-multipart-boundary)
- [BentoML command injection in Dockerfile generation via bentofile.yaml](https://junglewise.ai/threats/cve-2026-44346-bentoml-command-injection-in-dockerfile-generation-via-bentofile)