Command Injection in BentoML OpenLLM

Executive Summary

CVE-2026-15035 is a command injection vulnerability in the OpenLLM project, specifically in the async_run_command function of src/openllm/common.py. The vulnerability arises because the function uses asyncio.create_subprocess_shell to run commands by joining a list of command arguments into a single shell string without sanitizing inputs. This allows an attacker who can control model repository directory names to include shell metacharacters (such as ;, |, or $()) that get executed as commands on the victim's machine.

An attacker can exploit this vulnerability by creating a malicious model repository directory with a specially crafted name containing shell commands. When a user runs commands like 'openllm run' or 'openllm serve' using that repository, the injected shell commands execute with the user's privileges. The vulnerability requires local access to the victim's machine to exploit.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary command execution on your machine if you run OpenLLM commands using a maliciously named model repository directory. An attacker with local access can craft directory names that execute shell commands, potentially compromising your system.

• Execution of arbitrary commands with the privileges of the user running OpenLLM.
• Potential data compromise or system manipulation due to unauthorized command execution.
• Risk of malware installation, data exfiltration, or other malicious activities triggered by the injected commands.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves command injection through malicious model repository directory names when running OpenLLM commands like `openllm run` or `openllm serve`. Detection involves checking for suspicious directory names containing shell metacharacters such as `;`, `$()`, or backticks (`).

You can inspect your model repository directories for unusual or suspicious names that might include shell metacharacters.

• Use commands like `ls -l` or `find` to list directory names and look for suspicious characters, for example: `ls -l /path/to/model/repository`
• Check running OpenLLM processes for unexpected commands or arguments by using `ps aux | grep openllm`.
• Monitor system logs or command history for unusual commands triggered by OpenLLM executions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid running OpenLLM commands (`openllm run` or `openllm serve`) with untrusted or attacker-controlled model repository directories that may contain malicious directory names.

Update OpenLLM to a version that includes the security fix which replaces the vulnerable `asyncio.create_subprocess_shell` call with `asyncio.create_subprocess_exec`, preventing shell interpretation of command arguments.

As an immediate workaround, sanitize or rename model repository directory names to remove any shell metacharacters before running OpenLLM commands.

Limit local user permissions to prevent untrusted users from creating malicious directory names in model repositories.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CVE-2026-15035 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0