BentoML, a Python library for AI model serving, contained a flaw in versions prior to 1.4.37. The field name "docker.system_packages" in a bentofile.yaml file was treated as raw text and inserted directly into Dockerfile RUN commands. This allowed any string supplied in that list to be executed as a shell command, providing attackers with the ability to run arbitrary code while the container image is built.

Any deployment using BentoML library versions earlier than 1.4.37 that employs the docker.system_packages field to specify operating system packages. Attackers who control the bentofile.yaml or have influence over the build process can exploit the vulnerability.

The vulnerability has a CVSS score of 7.8, indicating high severity, but an EPSS score of less than 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog, and the attack vector is inferred to be local to the build environment, requiring control over the bentofile.yaml used during containerization. Because the flaw allows execution of arbitrary shell commands on the builder host, it can lead to full compromise of the build infrastructure if not mitigated.