TI-2024-02720 Aliases CVE-2024-2912 GHSA-hvj5-mvw9-93j3

Insecure Deserialization Leading to RCE in bentoml/bentoml

HIGH 82CWE-1188Published 2024-04-16 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01509 74th percentileScored 2026-11-07

Fix Fixed bentoml (PyPI): 1.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bentoml	bentoml/bentoml	1.2.0 – 1.2.4	—	No fix listed	CNA
—	bentoml (PyPI)	before 1.2.5	1.2.5	Patch available	GHSA-hvj5-mvw9-93j3

bentoml/bentoml Vendorbentoml Affected 1.2.0 – 1.2.4 Fixed in — No fix listed CNA
bentoml (PyPI) Vendor— Affected before 1.2.5 Fixed in 1.2.5 Patch available GHSA-hvj5-mvw9-93j3

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:bentoml:bentoml::::::::	—	—	bentoml

cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:* Versions — — ·bentoml

Remediation

Fix · GHSA-hvj5-mvw9-93j3 bentoml (PyPI) Fixed in 1.2.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-2912
2026-10-03 Alias added: GHSA-hvj5-mvw9-93j3

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-2912

Other 5

TI-2025-34190 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing CVSS 3.1CRITICAL 9.9
TI-2025-23454 Insecure Deserialization leads to RCE in BentoML's runner server CVSS 3.1CRITICAL 9.8
TI-2025-20352 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization CVSS 3.1CRITICAL 9.8
TI-2024-08420 Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml CVSS 3.0CRITICAL 9.8
TI-2026-27247 BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation CVSS 3.1CRITICAL 9.6
TI-2026-32312 BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml CVSS 3.1HIGH 8.8

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences