Threats affecting pkg:pypi/BentoML

BentoML versions up to 1.4.39 have a Dockerfile instruction injection vulnerability. This flaw allows attackers to inject arbitrary Docker build instructions by embedding newlines in docker.env mapping keys processed by the legacy base.j2 template. Exploitation requires supplying a crafted bentofile.yaml or imported bento archive, causing the containerize command to execute injected RUN instructions during docker build. This can lead to unauthorized access to build secrets and image poisoning.

BentoML versions 1.4.19 through 1.4.39 contain a Server-Side Request Forgery (SSRF) vulnerability in the make_safe_connect function. This function blocks private, loopback, and link-local IP addresses but does not block the RFC 6598 shared address space (100.64.0.0/10, CGNAT). An unauthenticated attacker can exploit this by supplying URLs pointing to this CGNAT range via multipart file handling or JSON request parsing, causing the server to make unintended outbound requests. This vulnerability is an incomplete fix of a previous issue (CVE-2025-54381).

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.