Vulnerability Description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bentoml | Bentoml | < 1.4.37 |
Related Weaknesses (CWE)
References
- https://github.com/bentoml/BentoML/security/advisories/GHSA-jfjg-vc52-wqvfExploitMitigationVendor Advisory
FAQ
What is CVE-2026-33744?
CVE-2026-33744 is a vulnerability with a CVSS score of 7.8 (HIGH). BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary str...
How severe is CVE-2026-33744?
CVE-2026-33744 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33744?
Check the references section above for vendor advisories and patch information. Affected products include: Bentoml Bentoml.