Executive Summary

CVE-2026-33744 is a command injection vulnerability in the BentoML Python library versions prior to 1.4.37. It arises because the `docker.system_packages` field in the `bentofile.yaml` configuration file accepts arbitrary strings that are directly inserted into Dockerfile RUN commands without any sanitization or escaping.

Users expect `system_packages` to be a list of OS package names, but because these values are interpolated verbatim into shell commands during Docker image builds, a maliciously crafted package name can inject and execute arbitrary shell commands.

For example, if a package name includes shell operators like `&&` followed by a command, that command will be executed as root during the Docker build process, leading to arbitrary code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands as root during the Docker image build process when using BentoML's containerization features.

• Attackers can publish malicious BentoML projects with crafted `bentofile.yaml` files that execute harmful commands.
• CI/CD pipelines that automatically build BentoML containers from user-submitted code are at risk of remote code execution.
• Cloud services like BentoCloud that build images from user-supplied configurations may be compromised.
• There is a supply chain risk where shared BentoML models or repositories could propagate malicious code.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the `bentofile.yaml` files used in your BentoML projects, specifically looking at the `docker.system_packages` field for any suspicious or unexpected shell command injections instead of just package names.

You can also monitor Docker build logs or the output of `bentoml containerize` or `bentoml build` commands for unexpected command execution or side effects such as creation of unusual files (e.g., /tmp/bentoml-pwned).

Suggested commands to detect exploitation attempts or suspicious activity include:

• Search for suspicious entries in bentofile.yaml: `grep -E 'system_packages:' -A 5 bentofile.yaml | grep -vE '^[[:space:]]*-'` to find non-package strings.
• Check Docker build logs for unexpected commands or errors.
• Look for unexpected files created during build, e.g., `ls -l /tmp/bentoml-pwned`.
• Use process monitoring tools during build to detect unexpected command execution.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade BentoML to version 1.4.37 or later, where this vulnerability is fixed.

If upgrading is not immediately possible, avoid using or accepting untrusted `bentofile.yaml` files that specify the `docker.system_packages` field.

Implement input validation on the `system_packages` field to ensure only valid package names are allowed, restricting characters to alphanumeric, dots, plus signs, hyphens, underscores, and colons.

Apply output escaping (e.g., using `shlex.quote()` in code and appropriate Jinja2 filters) to sanitize package names before inserting them into Dockerfile commands.

Review and audit CI/CD pipelines and cloud build environments that run BentoML builds to prevent execution of malicious code from crafted `bentofile.yaml` files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution during Docker image builds by injecting shell commands into the `system_packages` field of BentoML's configuration. Such unauthorized code execution can lead to compromise of system integrity, confidentiality, and availability.

Because of the high impact on confidentiality, integrity, and availability, this vulnerability poses significant risks to environments that must comply with standards like GDPR and HIPAA, which require strict controls to protect sensitive data and ensure system security.

Specifically, exploitation could lead to unauthorized access or modification of sensitive data, violating data protection requirements and potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0