CVE-2026-44346: BentoML command injection in Dockerfile generation via bentofile.yaml

CVE-2026-44346 · Severity: high · CVSS 8.8 · Published 2026-05-27

BentoML is a platform for building and deploying machine learning models. A vulnerability exists where a specially crafted configuration file can inject malicious commands into the container build process. If a user imports a malicious model and attempts to containerize it, an attacker could execute arbitrary code on the user's build machine, potentially leading to data theft or full system compromise.

Technologies: bentoml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44346 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44346 being exploited in the wild.
How severe is CVE-2026-44346?
High severity, with a CVSS score of 8.8, published 27 May 2026.
Which products and versions are affected?
bentoml (PyPI) <= 1.4.38, ECOSYSTEM:introduced=0,fixed=1.4.39.
Is there a fix for CVE-2026-44346?
Yes. bentoml (PyPI): upgrade to 1.4.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44346 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44346?
Check whether you run bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • bentoml (PyPI): upgrade to 1.4.39 or later
    pip install "bentoml>=1.4.39"

Technical details

A command injection vulnerability exists in BentoML's Dockerfile generation logic. The `envs[*].name` field in `bentofile.yaml` is interpolated raw into Jinja2 templates (specifically `base_v2.j2`) without proper escaping or newline filtering. An attacker can craft a `bentofile.yaml` with newline-injected values in the environment variable names to insert arbitrary `RUN` directives into the resulting Dockerfile. When a victim runs `bentoml containerize` on a malicious bento, these injected commands execute on the host during the `docker build` phase. This is a sibling vulnerability to CVE-2026-33744 and CVE-2026-35043, which addressed similar issues in other fields. The issue is fixed in version 1.4.39.

Affected products

  • BentoML bentoml <= 1.4.38

Identifiers

  • CVE-2026-44346
  • GHSA-w2pm-x38x-jp44
  • PYSEC-2026-190

Timeline

  • 2026-05-11: advisory: GitHub Advisory GHSA-w2pm-x38x-jp44 published
  • 2026-05-27: disclosed: NVD publication of CVE-2026-44346
  • 2026-05-07: patched: Version 1.4.39 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.