BentoML versions from 1.3.4 up to but not including 1.4.3 contain a critical remote code execution vulnerability due to insecure deserialization in the deserialize_value function. An unauthenticated attacker can send maliciously crafted pickle data via HTTP requests to execute arbitrary code on the server. This flaw is fixed in version 1.4.3.