Vulnerabilities

TI-2026-32311 CVE-2026-44345 · GHSA-78f9-r8mh-4xm2

BentoML: Dockerfile command injection via docker.base_image

HIGH 73

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00317 Published 2026-05-27 Fixed in 1.4.39 CWE-78

TI-2026-32312 CVE-2026-44346 · GHSA-w2pm-x38x-jp44

BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml

HIGH 73

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00321 Published 2026-05-27 Fixed in 1.4.39 CWE-78

TI-2026-29345 CVE-2026-40610 · GHSA-mcfx-4vc6-qgxv

BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

MEDIUM 58

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00284 Published 2026-05-22 Fixed in 1.4.39 CWE-59

TI-2026-27247 CVE-2026-35044 · GHSA-v959-cwq9-7hr6

BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation

HIGH 76

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00398 Published 2026-04-06 Fixed in 1.4.38 CWE-1336

TI-2026-27246 CVE-2026-35043 · GHSA-fgv4-6jr3-jgfw

BentoML: command injection in cloud deployment setup script (deployment.py)

HIGH 69

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00321 Published 2026-04-06 Fixed in 1.4.38 CWE-78

TI-2026-26123 CVE-2026-33744 · GHSA-jfjg-vc52-wqvf

BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

HIGH 69

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00261 Published 2026-03-27 Fixed in 1.4.37 CWE-94

TI-2026-22249 CVE-2026-27905 · GHSA-m6w7-qv66-g3mf

BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

HIGH 72

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00293 Published 2026-03-03 Fixed in 1.4.36 CWE-59

TI-2026-19441 CVE-2026-24123 · GHSA-6r62-w2q3-48hf

BentoML has a Path Traversal via Bentofile Configuration

LOW 33

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00491 Published 2026-01-26 Fixed in 1.4.34 CWE-22

TI-2025-34190 CVE-2025-54381 · GHSA-mrmq-3q62-6cc8

BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

HIGH 82

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.13177 Published 2025-07-29 Fixed in 1.4.19 CWE-918

TI-2025-23454 CVE-2025-32375 · GHSA-7v4r-c989-xh26

Insecure Deserialization leads to RCE in BentoML's runner server

HIGH 82

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.52415 Published 2025-04-09 Fixed in 1.4.8 CWE-502

TI-2025-20352 CVE-2025-27520 · GHSA-33xw-247w-6hmc

BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

HIGH 82

BentoML is a Python library for building online serving systems optimized for AI apps and model inference.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.4062 Published 2025-04-04 Fixed in 1.4.3 CWE-502

Vulnerabilities

Filters