Threats tagged 'ghsa-hvj5-mvw9-93j3'

CVE-2024-2912 is an insecure deserialization vulnerability in the BentoML framework that allows remote code execution via a specially crafted POST request. Attackers can exploit this flaw by sending malicious serialized objects to any valid BentoML endpoint, resulting in arbitrary command execution on the server. This vulnerability affects BentoML versions prior to 1.2.5 and has been assigned a critical severity rating with a CVSS score of 9.8. A fix is available in version 1.2.5.