Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44345BentoML: Dockerfile command injection via docker.base_image

High 8.8

In plain English

A high-severity OS command injection in BentoML from bentoml. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 75.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	bentoml	1.4.39	GHSA-78f9-r8mh-4xm2
PyPI	bentoml	1.4.39	PYSEC-2026-189

Affected products (as reported)

Vendor	Product	Versions
bentoml	BentoML	< 1.4.39

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/bentoml/BentoML/security/advisories/GHSA-78f9-r8mh-4xm2 x_refsource_CONFIRM