https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T13:58:25.776774+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-35043 CVE-2026-35043 — BentoML: command injection in cloud deployment setup script (deployment.py) 2026-10-08T13:58:25.796879+00:00

Affected: BentoML

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/_internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates system_packages directly into a shell command using an f-string without any quoting. The generated script is uploaded to BentoCloud as setup.sh and executed on the cloud build infrastructure during deployment, making this a remote code execution on the CI/CD tier. This vulnerability is fixed in 1.4.38.