Is CVE-2026-44345 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44345 being exploited in the wild.

How severe is CVE-2026-44345?

High severity, with a CVSS score of 8.8, published 27 May 2026.

Which products and versions are affected?

bentoml (PyPI) <= 1.4.38, ECOSYSTEM:introduced=0,fixed=1.4.39.

Is there a fix for CVE-2026-44345?

Yes. bentoml (PyPI): upgrade to 1.4.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44345 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44345?

Check whether you run bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44345: BentoML command injection in Dockerfile base_image template

Q: Which products and versions are affected?

bentoml (PyPI) <= 1.4.38, ECOSYSTEM:introduced=0,fixed=1.4.39.

Q: Is there a fix for CVE-2026-44345?

Yes. bentoml (PyPI): upgrade to 1.4.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44345 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44345?

Check whether you run bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44345 · Severity: high · CVSS 8.8 · Published 2026-05-27

BentoML is a platform used to package and deploy machine learning models. A security vulnerability allows an attacker to hide malicious commands inside a model configuration file. If a user tries to build a container image from a compromised model, these hidden commands will execute on their computer, potentially allowing the attacker to steal data or take control of the system.

Technologies: bentoml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44345 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44345 being exploited in the wild.
How severe is CVE-2026-44345?: High severity, with a CVSS score of 8.8, published 27 May 2026.
Which products and versions are affected?: bentoml (PyPI) <= 1.4.38, ECOSYSTEM:introduced=0,fixed=1.4.39.
Is there a fix for CVE-2026-44345?: Yes. bentoml (PyPI): upgrade to 1.4.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44345 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44345?: Check whether you run bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bentoml (PyPI): upgrade to 1.4.39 or later
```
pip install "bentoml>=1.4.39"
```

Technical details

A command injection vulnerability exists in BentoML's Dockerfile generation logic. The Jinja2 template `base_v2.j2` interpolates the `docker.base_image` value from `bento.yaml` without validation or newline filtering. By providing a multi-line string containing `RUN` directives, an attacker can achieve arbitrary code execution on the host running `bentoml containerize` when it invokes `docker build`. This is a member of a class of injection bugs affecting several fields in the build configuration. The issue is fixed in version 1.4.39 by implementing stricter validation on configuration fields.

Affected products

BentoML BentoML <= 1.4.38

Identifiers

CVE-2026-44345
GHSA-78f9-r8mh-4xm2
PYSEC-2026-189

Timeline

2026-05-07: disclosed: Advisory published by maintainers
2026-05-11: advisory: GHSA published
2026-05-27: advisory: NVD published CVE-2026-44345
2026-04-28: other: Vulnerability identified in main branch code

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.