The vulnerability originates in the async_run_command function of the Model Repository Directory Name Handler within bentoml OpenLLM. An attacker who can manipulate the cmd argument supplied to this function can inject shell metacharacters and cause the underlying shell to execute arbitrary commands on the host system. The weakness corresponds to CWE‑74, CWE‑77, and CWE‑78, indicating improper handling of command input, lack of sanitization, and OS command injection.

The affected product is bentoml OpenLLM version 0.6.30. No other versions or vendor products are listed as affected, and application of the vulnerability is limited to this specific release.

The CVSS score of 4.8 denotes moderate severity, while the EPSS score of 2% indicates a low probability of exploitation in the general population. The exploit has been publicly released, yet it requires local access to the target service, and the vulnerability is not listed in the CISA KEV catalog. Consequently, an attacker who can reach the OpenLLM service locally could leverage the command injection to gain control over the underlying host.