PT-2025-14902 · Bentoml · Bentoml
C2An1
·
Published
2025-04-04
·
Updated
2026-04-08
·
CVE-2025-27520
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BentoML versions 1.3.8 through 1.4.2
Description
A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in BentoML. It allows any unauthenticated user to execute arbitrary code on the server. The vulnerability exists due to an unsafe code segment in
serde.py, which can be exploited by sending a malicious serialized pickle object in an HTTP request. This can lead to the execution of harmful actions during deserialization.Recommendations
To resolve the issue, update to version 1.4.3 or later, as this version fixes the vulnerability. For versions 1.3.8 through 1.4.2, update to version 1.4.3 as soon as possible to mitigate the RCE vulnerability. As a temporary workaround, consider restricting access to the vulnerable
serde.py module to minimize the risk of exploitation.Exploit
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bentoml