BentoML’s cloud deployment path was vulnerable to command injection due to an unsanitized f-string that interpolated system_packages directly into a shell command. The resulting setup script is uploaded to BentoCloud and executed on the build infrastructure, allowing an attacker to run arbitrary commands. This flaw can lead to complete compromise of the cloud deployment environment, affecting confidentiality, integrity, and availability of the deployed service.

The vulnerability affects the BentoML Python library, specifically versions earlier than 1.4.38. Users deploying models to BentoCloud using the affected deployment.py script are at risk.

With a CVSS score of 7.8, the severity is high. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to submit a deployment to BentoCloud that triggers the vulnerable script; no local privilege escalation or network compromise is required, as the attack vector is the CI/CD tier of BentoCloud. The exploit is straightforward once a deployment is created, with no complex prerequisite conditions cited in the advisory.