A specially crafted bento.yaml file can insert arbitrary Dockerfile directives into the generated Dockerfile because the docker.base_image value is interpolated without escaping or validation. When bentoml containerize executes a docker build, the injected RUN directives run on the host, giving the attacker unrestricted code execution. The weakness, a form of operating system command injection, is identified as CWE‑78.

The vulnerability affects BentoML versions earlier than 1.4.39 of the BentoML Python library.

The CVSS score of 8.8 classifies the flaw as high severity, while the EPSS score is not available and it is not listed in the CISA KEV catalog. Exploitation requires the ability to supply a malicious bento.yaml and to invoke the containerize process; the attack vector is local and dependent on the attacker’s access to the host environment. If an attacker can alter the bento.yaml file, the injected commands execute with the privileges of the user running docker, potentially compromising the entire system.