BentoML’s containerization process reads envs[*].name from bentofile.yaml and directly inserts them into the generated Dockerfile without quoting. A malicious bento can inject newline characters into these names, breaking the Dockerfile syntax and turning the value into an unquoted RUN directive. During the docker build, the injected command executes with the privileges of the Docker daemon, giving the attacker arbitrary code execution on the host. This flaw is an example of OS Command Injection (CWE‑78) and code injection (CWE‑94).

The affected product is BentoML, a Python library and CLI used for serving AI models. Versions before 1.4.39 are vulnerable. Any system that runs bentoml containerize on a bento built from a malicious or compromised bentofile.yaml is susceptible.

The CVSS score of 8.8 signifies a high severity vulnerability. The EPSS score is not available, so the current exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by supplying a crafted bentofile.yaml that includes a newline in an env name; the attacker must then invoke bentoml containerize on the target host, which could be a local or remote scenario if the host processes files from untrusted sources. Once triggered, arbitrary host commands run under Docker’s build context, potentially compromising the entire system. The issue is fixed in BentoML 1.4.39.