PT-2026-30282 · Bentoml+1 · Bentoml+1
Offset
·
Published
2026-04-03
·
Updated
2026-04-06
·
CVE-2026-35044
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BentoML versions prior to 1.4.38
Description
BentoML is a Python library used for building and serving AI applications. A flaw exists in the Dockerfile generation function
generate containerfile() located in src/bentoml/ internal/container/generate.py. This function utilizes an unsandboxed jinja2.Environment with the jinja2.ext.do extension to process user-provided dockerfile template files. When a user imports a malicious bento archive and executes bentoml containerize, attacker-controlled Jinja2 template code can execute arbitrary Python code directly on the host machine, effectively bypassing container isolation. The vulnerability stems from the use of jinja2.ext.do, which allows the execution of Python expressions within Jinja2 templates. An attacker can craft a malicious dockerfile template containing code that, when rendered, executes arbitrary commands on the host system. This can lead to full access to the host filesystem, the ability to install backdoors, and potential supply chain compromise.Recommendations
Update to BentoML version 1.4.38 or later. If updating is not immediately possible, replace the unsandboxed
jinja2.Environment with jinja2.sandbox.SandboxedEnvironment and remove the jinja2.ext.do and jinja2.ext.debug extensions from the Jinja2 environment configuration in src/bentoml/ internal/container/generate.py. Also, apply the same fix to the second unsandboxed Environment in build config.py:499-504.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bentoml
Jinja2