https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T15:30:00.700195+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-35044 CVE-2026-35044 — BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation 2026-10-08T15:30:00.701813+00:00

Affected: BentoML

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38.

 https://cve.radiocsirt.org/vuln/ghsa-v959-cwq9-7hr6 GHSA-v959-cwq9-7hr6 — BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation 2026-10-08T15:30:00.701867+00:00

Affected: PyPI: bentoml

## Summary

The Dockerfile generation function `generate_containerfile()` in `src/bentoml/_internal/container/generate.py` uses an unsandboxed `jinja2.Environment` with the `jinja2.ext.do` extension to render user-provided `dockerfile_template` files. When a victim imports a malicious bento archive and runs `bentoml containerize`, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation.

## Details

The vulnerability exists in the `generate_containerfile()` function at `src/bentoml/_internal/container/generate.py:155-157`:

```python ENVIRONMENT = Environment( extensions=["jinja2.ext.do", "jinja2.ext.loopcontrols", "jinja2.ext.debug"], trim_blocks=True, lstrip_blocks=True, loader=FileSystemLoader(TEMPLATES_PATH, followlinks=True), ) ```

This creates an **unsandboxed** `jinja2.Environment` with two dangerous extensions: - `jinja2.ext.do` — enables `{% do %}` tags that execute arbitrary Python expressions - `jinja2.ext.debug` — exposes internal template engine state

**Attack path:**

1. **Attacker builds a bento** with `dockerfile_template` set in `bentofile.yaml`. During `bentoml build`, `DockerOptions.write_to_bento()` (`build_config.py:272-276`) copies the template file into the bento archive at `env/docker/Dockerfile.template`:

```python if self.dockerfile_template is not None: shutil.copy2( resolve_user_filepath(self.dockerfile_template, build_ctx), docker_fol…