CVE-2025-27520
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
Analysis
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deserialization. The serving endpoint accepts pickled Python objects that are deserialized without validation, allowing attackers to execute arbitrary code on any BentoML inference server.
Technical Context
BentoML's HTTP serving endpoint accepts serialized Python objects for model inference. The framework uses Python's pickle module to deserialize incoming request data without implementing any security controls or class allowlisting. An attacker can craft a malicious pickled object containing a __reduce__ method that executes arbitrary Python code during deserialization.
Affected Products
['BentoML <= 1.4.2']
Remediation
Update to BentoML 1.4.3 or later. Never expose BentoML serving endpoints directly to the internet without authentication. Implement network-level access controls. Consider using safer serialization formats (JSON, Protocol Buffers) instead of pickle for inference requests.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today