CVE-2026-33744 BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
Attackers can execute arbitrary commands during containerization by injecting shell commands into the system_packages field of bentofile.yaml.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33744?
CVE-2026-33744 is a high-severity command injection vulnerability in BentoML, published on 27 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.
Weakness: CWE-94
Which versions are affected by CVE-2026-33744?
3 open source packages ship an affected version, including bentoml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bentoml PyPI | All versions | 1.4.37 |
bentoml PyPI | All versions | 1.4.37 |
bentoml PyPI | All versions | 1.4.37 |
Products include Bentoml Bentoml.
How do I fix CVE-2026-33744?
Upgrade bentoml to 1.4.37 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-33744 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33744 exists.
Other vulnerabilities in BentoML
- CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing
- CVE-2025-32375 Insecure Deserialization leads to RCE in BentoML's runner server
- CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
- CVE-2026-44345 BentoML: Dockerfile command injection via docker.base_image
- CVE-2026-44346 BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml
Sources
Also known as GHSA-jfjg-vc52-wqvf, PYSEC-2026-157.