BentoML’s Dockerfile generation function creates an unsandboxed Jinja2 environment that processes user‑provided templates. An attacker can embed malicious Jinja2 code into a bento archive; when a victim imports that archive and runs the containerize command, the template engine will execute arbitrary Python on the host machine. This bypasses container isolation and allows the attacker to run code with the privileges of the BentoML process, leading to full system compromise.

Any installation of BentoML before version 1.4.38 that performs containerization is affected. The vulnerability is triggered when a user imports a bento archive from an untrusted source and then executes the containerize operation, regardless of the underlying operating system or deployment environment.

The severity is high with a CVSS score of 8.8. The probability of active exploitation is low, as indicated by an EPSS score below 1% and the absence of listing in the KEV catalog. Exploitation requires an attacker to supply a malicious bento archive to a victim that imports it and runs the containerization command; once triggered, the attacker gains arbitrary code execution on the host, putting all data and services at risk.