{"url":"http://public2.vulnerablecode.io/api/packages/43772?format=json","purl":"pkg:pypi/bentoml@1.2.0","type":"pypi","namespace":"","name":"bentoml","version":"1.2.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":null,"latest_non_vulnerable_version":null,"affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/23047?format=json","vulnerability_id":"VCID-2kem-3zpv-9yfj","summary":"BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction\nThe `safe_extract_tarfile()` function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, **not the symlink's target**. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27905","reference_id":"","reference_type":"","scores":[{"value":"0.0001","scoring_system":"epss","scoring_elements":"0.01108","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-27905"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670","reference_id":"","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-04T21:23:29Z/"}],"url":"https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27905","reference_id":"CVE-2026-27905","reference_type":"","scores":[{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27905"},{"reference_url":"https://github.com/advisories/GHSA-m6w7-qv66-g3mf","reference_id":"GHSA-m6w7-qv66-g3mf","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m6w7-qv66-g3mf"},{"reference_url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf","reference_id":"GHSA-m6w7-qv66-g3mf","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"8.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-04T21:23:29Z/"}],"url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47971?format=json","purl":"pkg:pypi/bentoml@1.4.36","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-8fmm-wxbk-7qcb"},{"vulnerability":"VCID-fvk4-zxh6-kuhs"},{"vulnerability":"VCID-urh1-515z-s3fg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.4.36"}],"aliases":["CVE-2026-27905","GHSA-m6w7-qv66-g3mf"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2kem-3zpv-9yfj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19911?format=json","vulnerability_id":"VCID-7ma3-q9pr-5ubm","summary":"Insecure deserialization in BentoML\nAn insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-2912","reference_id":"","reference_type":"","scores":[{"value":"0.07494","scoring_system":"epss","scoring_elements":"0.91907","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-2912"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/bentoml/commit/fd70379733c57c6368cc022ac1f841b7b426db7b","reference_id":"","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-06-05T19:41:39Z/"}],"url":"https://github.com/bentoml/bentoml/commit/fd70379733c57c6368cc022ac1f841b7b426db7b"},{"reference_url":"https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68","reference_id":"","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-06-05T19:41:39Z/"}],"url":"https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2912","reference_id":"CVE-2024-2912","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2912"},{"reference_url":"https://github.com/advisories/GHSA-hvj5-mvw9-93j3","reference_id":"GHSA-hvj5-mvw9-93j3","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hvj5-mvw9-93j3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/43778?format=json","purl":"pkg:pypi/bentoml@1.2.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2kem-3zpv-9yfj"},{"vulnerability":"VCID-7uh5-r7gx-qka6"},{"vulnerability":"VCID-8fmm-wxbk-7qcb"},{"vulnerability":"VCID-c64b-txym-9fgf"},{"vulnerability":"VCID-fvk4-zxh6-kuhs"},{"vulnerability":"VCID-ha3w-dtg7-4fbq"},{"vulnerability":"VCID-urh1-515z-s3fg"},{"vulnerability":"VCID-yuf4-1dgj-7qgm"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.2.5"}],"aliases":["CVE-2024-2912","GHSA-hvj5-mvw9-93j3"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7ma3-q9pr-5ubm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/276854?format=json","vulnerability_id":"VCID-7uh5-r7gx-qka6","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9056","reference_id":"","reference_type":"","scores":[{"value":"0.00304","scoring_system":"epss","scoring_elements":"0.53941","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9056"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/io_descriptors/file.py#L293","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/io_descriptors/file.py#L293"},{"reference_url":"https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/io_descriptors/file.py#L293C9-L293C66","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/io_descriptors/file.py#L293C9-L293C66"},{"reference_url":"https://huntr.com/bounties/a24a13c2-0300-4a95-b26a-ac7fe8f6521b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:52:04Z/"}],"url":"https://huntr.com/bounties/a24a13c2-0300-4a95-b26a-ac7fe8f6521b"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9056","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9056"},{"reference_url":"https://github.com/advisories/GHSA-hw8j-hw49-752c","reference_id":"GHSA-hw8j-hw49-752c","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hw8j-hw49-752c"}],"fixed_packages":[],"aliases":["CVE-2024-9056","GHSA-hw8j-hw49-752c"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7uh5-r7gx-qka6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9591?format=json","vulnerability_id":"VCID-8fmm-wxbk-7qcb","summary":"BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33744","reference_id":"","reference_type":"","scores":[{"value":"8e-05","scoring_system":"epss","scoring_elements":"0.0082","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33744"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-jfjg-vc52-wqvf","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-27T20:01:10Z/"}],"url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-jfjg-vc52-wqvf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33744","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33744"},{"reference_url":"https://github.com/advisories/GHSA-jfjg-vc52-wqvf","reference_id":"GHSA-jfjg-vc52-wqvf","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jfjg-vc52-wqvf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47972?format=json","purl":"pkg:pypi/bentoml@1.4.37","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fvk4-zxh6-kuhs"},{"vulnerability":"VCID-urh1-515z-s3fg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.4.37"}],"aliases":["CVE-2026-33744","GHSA-jfjg-vc52-wqvf","PYSEC-2026-157"],"risk_score":3.5,"exploitability":"0.5","weighted_severity":"7.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8fmm-wxbk-7qcb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22249?format=json","vulnerability_id":"VCID-c64b-txym-9fgf","summary":"BentoML has a Path Traversal via Bentofile Configuration\nBentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24123","reference_id":"","reference_type":"","scores":[{"value":"0.00015","scoring_system":"epss","scoring_elements":"0.03526","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24123"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-27T21:36:54Z/"}],"url":"https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4"},{"reference_url":"https://github.com/bentoml/BentoML/releases/tag/v1.4.34","reference_id":"","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-27T21:36:54Z/"}],"url":"https://github.com/bentoml/BentoML/releases/tag/v1.4.34"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24123","reference_id":"CVE-2026-24123","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24123"},{"reference_url":"https://github.com/advisories/GHSA-6r62-w2q3-48hf","reference_id":"GHSA-6r62-w2q3-48hf","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6r62-w2q3-48hf"},{"reference_url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf","reference_id":"GHSA-6r62-w2q3-48hf","reference_type":"","scores":[{"value":"7.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-27T21:36:54Z/"}],"url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47969?format=json","purl":"pkg:pypi/bentoml@1.4.34","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2kem-3zpv-9yfj"},{"vulnerability":"VCID-8fmm-wxbk-7qcb"},{"vulnerability":"VCID-fvk4-zxh6-kuhs"},{"vulnerability":"VCID-urh1-515z-s3fg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.4.34"}],"aliases":["CVE-2026-24123","GHSA-6r62-w2q3-48hf"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-c64b-txym-9fgf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9596?format=json","vulnerability_id":"VCID-fvk4-zxh6-kuhs","summary":"BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/_internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates system_packages directly into a shell command using an f-string without any quoting. The generated script is uploaded to BentoCloud as setup.sh and executed on the cloud build infrastructure during deployment, making this a remote code execution on the CI/CD tier. This vulnerability is fixed in 1.4.38.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35043","reference_id":"","reference_type":"","scores":[{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.08915","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35043"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-fgv4-6jr3-jgfw","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-07T14:09:04Z/"}],"url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-fgv4-6jr3-jgfw"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33744","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33744"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35043","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35043"},{"reference_url":"https://github.com/advisories/GHSA-fgv4-6jr3-jgfw","reference_id":"GHSA-fgv4-6jr3-jgfw","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fgv4-6jr3-jgfw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/48014?format=json","purl":"pkg:pypi/bentoml@1.4.38","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-d48j-9tqd-4yax"},{"vulnerability":"VCID-v96v-q2ga-pkbb"},{"vulnerability":"VCID-xs1q-xvga-kkhd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.4.38"}],"aliases":["CVE-2026-35043","GHSA-fgv4-6jr3-jgfw","PYSEC-2026-158"],"risk_score":3.5,"exploitability":"0.5","weighted_severity":"7.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fvk4-zxh6-kuhs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9379?format=json","vulnerability_id":"VCID-ha3w-dtg7-4fbq","summary":"BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32375","reference_id":"","reference_type":"","scores":[{"value":"0.65238","scoring_system":"epss","scoring_elements":"0.98501","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-32375"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-7v4r-c989-xh26","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-09T15:40:47Z/"}],"url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-7v4r-c989-xh26"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/bentoml/PYSEC-2025-32.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bentoml/PYSEC-2025-32.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32375","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32375"},{"reference_url":"https://github.com/advisories/GHSA-7v4r-c989-xh26","reference_id":"GHSA-7v4r-c989-xh26","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7v4r-c989-xh26"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/43830?format=json","purl":"pkg:pypi/bentoml@1.4.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2kem-3zpv-9yfj"},{"vulnerability":"VCID-8fmm-wxbk-7qcb"},{"vulnerability":"VCID-aq7y-5wqw-s3df"},{"vulnerability":"VCID-c64b-txym-9fgf"},{"vulnerability":"VCID-fvk4-zxh6-kuhs"},{"vulnerability":"VCID-urh1-515z-s3fg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.4.8"}],"aliases":["CVE-2025-32375","GHSA-7v4r-c989-xh26","PYSEC-2025-32"],"risk_score":4.4,"exploitability":"0.5","weighted_severity":"8.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ha3w-dtg7-4fbq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9597?format=json","vulnerability_id":"VCID-urh1-515z-s3fg","summary":"BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35044","reference_id":"","reference_type":"","scores":[{"value":"0.00023","scoring_system":"epss","scoring_elements":"0.06898","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35044"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-v959-cwq9-7hr6","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"9.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-06T18:49:50Z/"}],"url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-v959-cwq9-7hr6"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35044","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35044"},{"reference_url":"https://github.com/advisories/GHSA-v959-cwq9-7hr6","reference_id":"GHSA-v959-cwq9-7hr6","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v959-cwq9-7hr6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/48014?format=json","purl":"pkg:pypi/bentoml@1.4.38","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-d48j-9tqd-4yax"},{"vulnerability":"VCID-v96v-q2ga-pkbb"},{"vulnerability":"VCID-xs1q-xvga-kkhd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.4.38"}],"aliases":["CVE-2026-35044","GHSA-v959-cwq9-7hr6","PYSEC-2026-159"],"risk_score":4.3,"exploitability":"0.5","weighted_severity":"8.6","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-urh1-515z-s3fg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/276867?format=json","vulnerability_id":"VCID-yuf4-1dgj-7qgm","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9070","reference_id":"","reference_type":"","scores":[{"value":"0.0041","scoring_system":"epss","scoring_elements":"0.61635","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-9070"},{"reference_url":"https://github.com/bentoml/BentoML","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML"},{"reference_url":"https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/server/runner_app.py#L297","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/server/runner_app.py#L297"},{"reference_url":"https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/server/runner_app.py#L301","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/server/runner_app.py#L301"},{"reference_url":"https://huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-03-20T17:51:14Z/"}],"url":"https://huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9070","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9070"},{"reference_url":"https://github.com/advisories/GHSA-9g44-gwvm-hc44","reference_id":"GHSA-9g44-gwvm-hc44","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-9g44-gwvm-hc44"}],"fixed_packages":[],"aliases":["CVE-2024-9070","GHSA-9g44-gwvm-hc44"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yuf4-1dgj-7qgm"}],"fixing_vulnerabilities":[],"risk_score":"4.4","resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/bentoml@1.2.0"}