CVE-2026-44345 Details
Description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.
A command injection vulnerability has been identified in BentoML versions prior to 1.4.39. The issue arises in the Dockerfile template processing, where the 'docker.base_image' value from 'bento.yaml' is interpolated without proper validation or escaping. This flaw allows the injection of arbitrary Dockerfile commands, which are executed on the host during the Docker build process. The vulnerability is particularly concerning in scenarios where BentoML is used to share bento packages, as it could lead to unauthorized command execution on the recipient's machine.
Users should update to BentoML version 1.4.39 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bentoml/BentoML/security/advisories/GHSA-78f9-r8mh-4xm2 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/bentoml/BentoML/security/advisories/GHSA-78f9-r8mh-4xm2 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bentoml bentoml | < 1.4.39 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |