Bentoml
Monthly
BentoML through 1.4.39 renders attacker-controlled docker.env mapping keys into its legacy base.j2 Dockerfile template without neutralizing embedded newline characters, allowing injected Dockerfile instructions - typically RUN commands - to be executed during `bentoml containerize` builds. A victim must be induced to build or containerize an untrusted bentofile.yaml or imported bento archive, so exploitation is local and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) rather than remotely triggerable, but successful builds can expose any secrets mounted into the Docker build context and produce poisoned images that downstream users trust and deploy. No public exploit code or confirmed active exploitation was identified at time of analysis; realistic exposure is limited to teams that containerize third-party or otherwise untrusted bento content.
Arbitrary file write in BentoML allows an attacker-supplied bento or model tar archive to escape the extraction directory and overwrite files anywhere the BentoML process can write, affecting all versions prior to 1.4.36. The victim must import or pull the malicious artifact (CVE CVSS 3.1 base 8.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), so no credentials or direct network access to the host are needed, but the supply-chain ingestion step is mandatory - an idle installation that never processes an untrusted bento or model is not exposed. Publicly available exploit code exists, exploit-maturity scoring is minimal (EPSS 0.01%, 0th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing); the issue is real but not urgent, and a vendor patch exists in 1.4.36.
BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile.yaml configurations, enabling attackers to embed arbitrary files from the victim's system into bento archives during the build process. This vulnerability can be exploited to exfiltrate sensitive data such as credentials, SSH keys, and environment variables into supply chain artifacts that may be pushed to registries or deployed in production environments. A patch is available in version 1.4.34.
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 67.3%.
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deserialization. The serving endpoint accepts pickled Python objects that are deserialized without validation, allowing attackers to execute arbitrary code on any BentoML inference server.
Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing to block RFC 6598 shared address space (100.64.0.0/10) in the `make_safe_connect` safeguard. Unauthenticated remote attackers can supply crafted URLs via multipart file uploads or JSON request bodies, causing the BentoML server to make outbound requests to CGNAT-addressed internal hosts - a class of targets increasingly common in cloud-native and ISP environments. This is an incomplete fix for CVE-2025-54381; no public exploit has been identified at time of analysis, but the known patch gap and zero-prerequisite attack surface warrant prompt remediation.
Command injection in bentoml OpenLLM 0.6.30 allows local low-privilege users to execute arbitrary shell commands by supplying crafted model repository directory name arguments to the `async_run_command` function in `src/openllm/common.py`. A public proof-of-concept exploit is available per the CVSS 4.0 E:P modifier and disclosure notes, though no CISA KEV listing exists and the project had not responded to responsible disclosure at the time of reporting. The CVSS 4.0 base score of 1.9 reflects a constrained real-world risk profile due to the strictly local attack vector and limited Low-rated confidentiality, integrity, and availability impact.
BentoML through 1.4.39 renders attacker-controlled docker.env mapping keys into its legacy base.j2 Dockerfile template without neutralizing embedded newline characters, allowing injected Dockerfile instructions - typically RUN commands - to be executed during `bentoml containerize` builds. A victim must be induced to build or containerize an untrusted bentofile.yaml or imported bento archive, so exploitation is local and interaction-dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) rather than remotely triggerable, but successful builds can expose any secrets mounted into the Docker build context and produce poisoned images that downstream users trust and deploy. No public exploit code or confirmed active exploitation was identified at time of analysis; realistic exposure is limited to teams that containerize third-party or otherwise untrusted bento content.
Arbitrary file write in BentoML allows an attacker-supplied bento or model tar archive to escape the extraction directory and overwrite files anywhere the BentoML process can write, affecting all versions prior to 1.4.36. The victim must import or pull the malicious artifact (CVE CVSS 3.1 base 8.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), so no credentials or direct network access to the host are needed, but the supply-chain ingestion step is mandatory - an idle installation that never processes an untrusted bento or model is not exposed. Publicly available exploit code exists, exploit-maturity scoring is minimal (EPSS 0.01%, 0th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing); the issue is real but not urgent, and a vendor patch exists in 1.4.36.
BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile.yaml configurations, enabling attackers to embed arbitrary files from the victim's system into bento archives during the build process. This vulnerability can be exploited to exfiltrate sensitive data such as credentials, SSH keys, and environment variables into supply chain artifacts that may be pushed to registries or deployed in production environments. A patch is available in version 1.4.34.
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 67.3%.
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deserialization. The serving endpoint accepts pickled Python objects that are deserialized without validation, allowing attackers to execute arbitrary code on any BentoML inference server.
Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing to block RFC 6598 shared address space (100.64.0.0/10) in the `make_safe_connect` safeguard. Unauthenticated remote attackers can supply crafted URLs via multipart file uploads or JSON request bodies, causing the BentoML server to make outbound requests to CGNAT-addressed internal hosts - a class of targets increasingly common in cloud-native and ISP environments. This is an incomplete fix for CVE-2025-54381; no public exploit has been identified at time of analysis, but the known patch gap and zero-prerequisite attack surface warrant prompt remediation.
Command injection in bentoml OpenLLM 0.6.30 allows local low-privilege users to execute arbitrary shell commands by supplying crafted model repository directory name arguments to the `async_run_command` function in `src/openllm/common.py`. A public proof-of-concept exploit is available per the CVSS 4.0 E:P modifier and disclosure notes, though no CISA KEV listing exists and the project had not responded to responsible disclosure at the time of reporting. The CVSS 4.0 base score of 1.9 reflects a constrained real-world risk profile due to the strictly local attack vector and limited Low-rated confidentiality, integrity, and availability impact.