CVE-2026-35044 Details
Description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38.
A server-side template injection vulnerability has been identified in BentoML versions prior to 1.4.38. The issue arises in the Dockerfile generation function 'generate_containerfile()', which uses an unsandboxed Jinja2 environment to render user-provided Dockerfile templates. This vulnerability allows execution of arbitrary Python code on the host machine, bypassing container isolation, when a malicious Bento archive is imported and containerized.
Users should update to BentoML version 1.4.38 or later, where this vulnerability has been fixed. The update replaces the unsandboxed Jinja2 environment with a sandboxed environment, removing the dangerous extensions that allowed code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bentoml/BentoML/security/advisories/GHSA-v959-cwq9-7hr6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bentoml bentoml | < 1.4.38 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |