https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T04:44:16.300025+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33744 CVE-2026-33744 — BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml 2026-10-08T04:44:16.301885+00:00

Affected: BentoML

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-jfjg-vc52-wqvf GHSA-jfjg-vc52-wqvf — BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml 2026-10-08T04:44:16.301971+00:00

Affected: PyPI: bentoml

## Summary

The `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`.

## Affected Component

- `src/_bentoml_sdk/images.py:85-89` — `.format(packages=" ".join(packages))` into shell command - `src/bentoml/_internal/container/frontend/dockerfile/templates/base_debian.j2:13` — `{{ __options__system_packages | join(' ') }}` - `src/bentoml/_internal/bento/build_config.py:174` — No validation on `system_packages` - All distro install commands in `src/bentoml/_internal/container/frontend/dockerfile/__init__.py`

## Affected Versions

All versions supporting `docker.system_packages` in `bentofile.yaml`, confirmed on 1.4.36.

## Steps to Reproduce

1. Create a project directory with:

**service.py:** ```python import bentoml

@bentoml.service class MyService: @bentoml.api def predict(self) -> str: return "hello" ```

**bentofile.yaml:** ```yaml service: "service:MyService" docker: system_packages: - "curl && id > /tmp/bentoml-pwned #" ```

2. Run: ```bash bentoml build ```

3. Examine the generated Dockerfile at `~/bentoml/bentos/my_service/<tag>/env/docker/Dockerfile`. Line 41 will contain: ```dockerfile R…