Executive brief
BentoML is a platform used to package and deploy machine learning models. A security vulnerability allows an attacker to hide malicious commands inside a model configuration file. If a user tries to build a container image from a compromised model, these hidden commands will execute on their computer, potentially allowing the attacker to steal data or take control of the system.
Technical details
A command injection vulnerability exists in BentoML's Dockerfile generation logic. The Jinja2 template `base_v2.j2` interpolates the `docker.base_image` value from `bento.yaml` without validation or newline filtering. By providing a multi-line string containing `RUN` directives, an attacker can achieve arbitrary code execution on the host running `bentoml containerize` when it invokes `docker build`. This is a member of a class of injection bugs affecting several fields in the build configuration. The issue is fixed in version 1.4.39 by implementing stricter validation on configuration fields.
Affected products
- BentoML BentoML <= 1.4.38
Timeline
- 2026-05-07: disclosed: Advisory published by maintainers
- 2026-05-11: advisory: GHSA published
- 2026-05-27: advisory: NVD published CVE-2026-44345
- 2026-04-28: other: Vulnerability identified in main branch code