Bentoml vulnerabilities
We track 14 vulnerabilities in Bentoml products across 3 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest Bentoml vulnerabilities
- 7.8 High severity
BentoML: Improper Neutralization of Special Elements used in an OS Command
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted
- 7.8 High severity
OpenLLM: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command inject
- 8.8 High severity
BentoML: Improper Neutralization of Special Elements used in an OS Command
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated
- 8.8 High severity
BentoML: Improper Neutralization of Special Elements used in an OS Command
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline fi
- 9.6 Critical severity
BentoML: Improper Neutralization of Special Elements Used in a Template Engine
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.En
- 7.8 High severity
BentoML: Improper Neutralization of Special Elements used in an OS Command
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/_internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpo
- 7.8 High severity
BentoML: Improper Control of Generation of Code
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` co
- 7.8 High severity
BentoML: Improper Link Resolution Before File Access
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members i
- 9.9 Critical severity
BentoML: Server-Side Request Forgery
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force th
- 9.8 Critical severity
BentoML: Deserialization of Untrusted Data
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is p
- 9.8 Critical severity
BentoML: Deserialization of Untrusted Data
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows a
- 9.8 Critical severity
bentoml/bentoml: Deserialization of Untrusted Data
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered
- 7.5 High severity
bentoml/bentoml: Allocation of Resources Without Limits or Throttling
BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process
- 10.0 Critical severity
bentoml/bentoml: Initialization of a Resource with an Insecure Default
An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the Be