Most recent entries from all

EUVD-2026-277897

fkie_cve-2026-33744

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.

GHSA-jfjg-vc52-wqvf — BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

Affected: PyPI: bentoml

## Summary

The `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`.

## Affected Component

- `src/_bentoml_sdk/images.py:85-89` — `.format(packages=" ".join(packages))` into shell command - `src/bentoml/_internal/container/frontend/dockerfile/templates/base_debian.j2:13` — `{{ __options__system_packages | join(' ') }}` - `src/bentoml/_internal/bento/build_config.py:174` — No validation on `system_packages` - All distro install commands in `src/bentoml/_internal/container/frontend/dockerfile/__init__.py`

## Affected Versions

All versions supporting `docker.system_packages` in `bentofile.yaml`, confirmed on 1.4.36.

## Steps to Reproduce

1. Create a project directory with:

**service.py:** ```python import bentoml

@bentoml.service class MyService: @bentoml.api def predict(self) -> str: return "hello" ```

**bentofile.yaml:** ```yaml service: "service:MyService" docker: system_packages: - "curl && id > /tmp/bentoml-pwned #" ```

2. Run: ```bash bentoml build ```

3. Examine the generated Dockerfile at `~/bentoml/bentos/my_service/<tag>/env/docker/Dockerfile`. Line 41 will contain: ```dockerfile R…

PYSEC-2026-157

Affected: PyPI: bentoml