PT-2026-28523 · Bentoml · Bentoml

Golang-Not-Rust · Published 2026-03-26 · Updated 2026-04-03 · CVE-2026-33744

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.37

Description BentoML is a Python library used for building online serving systems for AI applications and model inference. A flaw exists where the docker.system packages field within the bentofile.yaml file does not properly sanitize arbitrary strings before they are interpolated into Dockerfile RUN commands. Because this field is intended to hold a list of OS package names (data), it is not expected to be interpreted as shell commands. This allows a malicious bentofile.yaml file to achieve arbitrary command execution during the bentoml containerize or docker build process. The issue resides in several components including src/ bentoml sdk/images.py, src/bentoml/ internal/container/frontend/dockerfile/templates/base debian.j2, src/bentoml/ internal/bento/build config.py, and all distro install commands in src/bentoml/ internal/container/frontend/dockerfile/ init .py. The impact of this issue includes potential compromise of malicious repositories, CI/CD pipelines, BentoCloud infrastructure, and the BentoML ecosystem's supply chain. The system packages field values are treated as data by the user but are directly formatted into shell commands in the Dockerfile without proper escaping.

Recommendations Versions prior to 1.4.37: Implement input validation for the system packages field in build config.py using a regular expression to ensure package names only contain alphanumeric characters, dots, plus signs, hyphens, underscores, and colons. Versions prior to 1.4.37: Apply shlex.quote() to each package name before interpolation in images.py:system packages() and apply the bash quote Jinja2 filter in base debian.j2.

Exploit

Fix

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

CVE-2026-33744

GHSA-FGV4-6JR3-JGFW

GHSA-JFJG-VC52-WQVF

PYSEC-2026-157

Affected Products

Bentoml

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33744.json · Exploit
• https://github.com/bentoml/BentoML/security/advisories/GHSA-jfjg-vc52-wqvf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jfjg-vc52-wqvf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35043 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33744 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-157 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fgv4-6jr3-jgfw · Vendor Advisory
• https://github.com/bentoml/BentoML/security/advisories/GHSA-fgv4-6jr3-jgfw · Note
• https://github.com/bentoml/BentoML · Note
• https://reddit.com/r/VulnMatter/comments/1s475si/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1s473iq/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://twitter.com/cyberbivash/status/2037363264292630549 · Twitter Post
• https://twitter.com/CVEnew/status/2037513385491693949 · Twitter Post
• https://twitter.com/CVEarity/status/2037491051699843213 · Twitter Post