CVE-2026-35044 BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation
Attackers can execute arbitrary Python code on the host by tricking users into containerizing a malicious bento archive using BentoML.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35044?
CVE-2026-35044 is a high-severity code injection vulnerability in BentoML, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38.
Weakness: CWE-1336
Which versions are affected by CVE-2026-35044?
3 open source packages ship an affected version, including bentoml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bentoml PyPI | All versions | 1.4.38 |
bentoml PyPI | All versions | 1.4.38 |
bentoml PyPI | All versions | 1.4.38 |
Products include Bentoml Bentoml.
How do I fix CVE-2026-35044?
Upgrade bentoml to 1.4.38 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-35044 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35044 exists.
Other vulnerabilities in BentoML
- CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing
- CVE-2025-32375 Insecure Deserialization leads to RCE in BentoML's runner server
- CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
- CVE-2026-44345 BentoML: Dockerfile command injection via docker.base_image
- CVE-2026-44346 BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml
Sources
Also known as GHSA-v959-cwq9-7hr6, PYSEC-2026-159.