EUVD-2026-42271
GHSA-6499-56p8-f7rq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack requiring low-privilege credentials with no scope change and limited Low-bounded impact across all three pillars.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in bentoml OpenLLM 0.6.30 allows local low-privilege users to execute arbitrary shell commands by supplying crafted model repository directory name arguments to the async_run_command function in src/openllm/common.py. A public proof-of-concept exploit is available per the CVSS 4.0 E:P modifier and disclosure notes, though no CISA KEV listing exists and the project had not responded to responsible disclosure at the time of reporting. The CVSS 4.0 base score of 1.9 reflects a constrained real-world risk profile due to the strictly local attack vector and limited Low-rated confidentiality, integrity, and availability impact.
Technical ContextAI
OpenLLM is an open-source large language model serving framework built on BentoML, designed to deploy and serve LLMs in production. The vulnerability resides in the async_run_command function within src/openllm/common.py, which handles model repository directory names. CWE-74 (Injection) identifies the root cause as insufficient neutralization of user-controlled input before it is passed to a command execution context - most likely an unsanitized shell invocation or subprocess call where directory name strings are interpolated directly. No CPE string was provided in the intelligence data, so affected version scope is limited to what the CVE description specifies (0.6.30). The component's role in parsing repository directory names means the injection surface is reached when a user interacts with model management operations.
RemediationAI
No vendor-released patch has been identified at time of analysis; the OpenLLM project had not responded to the responsible disclosure as of the report date. An upstream pull request addressing the issue is available at https://github.com/bentoml/OpenLLM/pull/1235, but a tagged patched release has not been independently confirmed - this constitutes an upstream fix available via PR/commit only, not a confirmed released version. As compensating controls, operators should restrict local user access to systems running OpenLLM 0.6.30 to trusted personnel only, avoiding multi-tenant or shared environments where untrusted local users could interact with model repository directory name inputs. Avoid passing untrusted or user-supplied strings as model repository directory names to the async_run_command function. Monitor https://github.com/bentoml/OpenLLM/ for a patched release and apply it immediately upon availability.
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
Arbitrary file write in BentoML prior to version 1.4.36 allows local attackers to write files to arbitrary locations on
BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile
Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing t
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today