CVE-2026-35044: high-severity vulnerability in BentoML
BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
exploitation probability
0.5%top 60% of all CVEs
observed exploitation
nono source reports it
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
bentoml · BentoMLRelated CVEs — BentoML
In the same product, most dangerous first.
CVE-2025-32375CRITICALInsecure Deserialization leads to RCE in BentoML's runner serverEPSS 52.4%CVE-2025-27520CRITICALBentoML Allows Remote Code Execution (RCE) via Insecure DeserializationEPSS 40.6%CVE-2025-54381CRITICALBentoML is Vulnerable to an SSRF Attack Through File Upload ProcessingEPSS 16.1%CVE-2026-24123HIGHBentoML has a Path Traversal via Bentofile ConfigurationEPSS 0.5%CVE-2026-44345HIGHBentoML: Dockerfile command injection via docker.base_imageEPSS 0.5%CVE-2026-44346HIGHBentoML: Dockerfile command injection via envs[*].name in bentofile.yamlEPSS 0.5%