https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:26:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322470 EUVD-2026-322470 https://cve.radiocsirt.org/vuln/euvd-2026-322470 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44346 <p>BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.</p> <p>BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44346 https://cve.radiocsirt.org/vuln/ghsa-w2pm-x38x-jp44 <p><strong>Affected:</strong> PyPI: bentoml</p> <p># BentoML `envs[*].name` Dockerfile command injection — sibling of CVE-2026-33744 / CVE-2026-35043</p> <p>A malicious `bentofile.yaml` containing a newline-injected value in `envs[*].name` produces unquoted `RUN` directives in the BentoML-generated Dockerfile. When the victim runs `bentoml containerize` on the imported bento, those `RUN` directives execute on the host during `docker build`. Verified end-to-end on `bentoml==1.4.38`.</p> <p>## Vulnerable code</p> <p>`src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2:71-73`:</p> <p>```jinja {% for env in __bento_envs__ %} {% set stage = env.stage | default(&#34;all&#34;) -%} {% if stage != &#34;runtime&#34; -%} ARG {{ env.name }}{% if env.value %}={{ env.value | bash_quote }}{% endif %} ENV {{ env.name }}=${{ env.name }} {% endif -%} {% endfor %} ```</p> <p>`env.value` is bash-quoted via the `bash_quote` filter, but **`env.name` is interpolated raw** with no escaping or newline filtering. The template is rendered by `_bentoml_impl/docker.generate_dockerfile` (the v2 SDK Docker generation path used by `bentoml containerize` for modern services).</p> <p>## Sibling relationship to existing CVEs</p> <p>The earlier patches addressed the same Dockerfile-command-injection class for a different bentofile field:</p> <p>- **CVE-2026-33744 / GHSA-jfjg-vc52-wqvf** (2026-03-25): added `bash_quote` to `system_packages` interpolation in Dockerfile templates and `images.py`. - **CVE-2026-35043 / GHSA-fgv4-6jr3-jgfw** (2026-04-02): added `shlex.quote` to `system_packages` in the cloud…</p> <p><strong>Affected:</strong> PyPI: bentoml</p> <p># BentoML `envs[*].name` Dockerfile command injection — sibling of CVE-2026-33744 / CVE-2026-35043</p> <p>A malicious `bentofile.yaml` containing a newline-injected value in `envs[*].name` produces unquoted `RUN` directives in the BentoML-generated Dockerfile. When the victim runs `bentoml containerize` on the imported bento, those `RUN` directives execute on the host during `docker build`. Verified end-to-end on `bentoml==1.4.38`.</p> <p>## Vulnerable code</p> <p>`src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2:71-73`:</p> <p>```jinja {% for env in __bento_envs__ %} {% set stage = env.stage | default(&#34;all&#34;) -%} {% if stage != &#34;runtime&#34; -%} ARG {{ env.name }}{% if env.value %}={{ env.value | bash_quote }}{% endif %} ENV {{ env.name }}=${{ env.name }} {% endif -%} {% endfor %} ```</p> <p>`env.value` is bash-quoted via the `bash_quote` filter, but **`env.name` is interpolated raw** with no escaping or newline filtering. The template is rendered by `_bentoml_impl/docker.generate_dockerfile` (the v2 SDK Docker generation path used by `bentoml containerize` for modern services).</p> <p>## Sibling relationship to existing CVEs</p> <p>The earlier patches addressed the same Dockerfile-command-injection class for a different bentofile field:</p> <p>- **CVE-2026-33744 / GHSA-jfjg-vc52-wqvf** (2026-03-25): added `bash_quote` to `system_packages` interpolation in Dockerfile templates and `images.py`. - **CVE-2026-35043 / GHSA-fgv4-6jr3-jgfw** (2026-04-02): added `shlex.quote` to `system_packages` in the cloud…</p> https://cve.radiocsirt.org/vuln/ghsa-w2pm-x38x-jp44 https://cve.radiocsirt.org/vuln/pysec-2026-190 <p><strong>Affected:</strong> PyPI: bentoml</p> <p>BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.</p> <p><strong>Affected:</strong> PyPI: bentoml</p> <p>BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.</p> https://cve.radiocsirt.org/vuln/pysec-2026-190