PT-2026-30281 · Bentoml · Bentoml

Kodareef5 · Published 2026-04-03 · Updated 2026-04-06 · CVE-2026-35043

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.38

Description BentoML contains a remote code execution (RCE) issue in the cloud deployment path within src/bentoml/ internal/cloud/deployment.py. Specifically, line 1648 interpolates system packages directly into a shell command using an f-string without proper quoting. This allows for command injection when the generated script, setup.sh, is uploaded to BentoCloud and executed during deployment. The vulnerability arises because the fix implemented in commit ce53491, which added shlex.quote to other areas of the code, was not applied to this specific path. The system packages values from bentofile.yaml are joined with spaces and directly interpolated into the apt-get install command, enabling an attacker to inject arbitrary commands. A proof of concept demonstrates that a malicious bentofile.yaml can be crafted to exfiltrate the hostname of the build infrastructure. This could lead to supply chain attacks, insider threats, or broader CI/CD compromise.

Recommendations Update to BentoML version 1.4.38 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-35043

GHSA-FGV4-6JR3-JGFW

PYSEC-2026-158

Affected Products

Bentoml

References · 7

• 🔥 https://github.com/bentoml/BentoML/security/advisories/GHSA-fgv4-6jr3-jgfw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33744 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-158 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fgv4-6jr3-jgfw · Vendor Advisory
• https://github.com/bentoml/BentoML · Note
• https://twitter.com/CVEnew/status/2041223962827354446 · Twitter Post