Python CVE-2025-27520
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
AnalysisAI
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deserialization. The serving endpoint accepts pickled Python objects that are deserialized without validation, allowing attackers to execute arbitrary code on any BentoML inference server.
Technical ContextAI
BentoML's HTTP serving endpoint accepts serialized Python objects for model inference. The framework uses Python's pickle module to deserialize incoming request data without implementing any security controls or class allowlisting. An attacker can craft a malicious pickled object containing a __reduce__ method that executes arbitrary Python code during deserialization.
RemediationAI
Update to BentoML 1.4.3 or later. Never expose BentoML serving endpoints directly to the internet without authentication. Implement network-level access controls. Consider using safer serialization formats (JSON, Protocol Buffers) instead of pickle for inference requests.
Share
External POC / Exploit Code
Leaving vuln.today