446 matches found
BentoML code-related vulnerabilities
BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable artificial intelligence applications using Python. A code issue vulnerability exists in BentoML versions prior to 1.4.8 that stems from insecure deserialization and could...
BentoML's runner server RCE
There was an insecure deserialization in BentoML's runner server prior to version 1.4.8. By setting specific headers and parameters in the POST request, it is possible to execute unauthorized arbitrary code in the context of the user running the server, which will grant initial access and...
CVE-2025-27520
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
Summary A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest versionv1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. Details It exists an unsafe code segment in serde.py: Python def...
ai-dynamo (0.1.0), openllm (0.6.19) potentially affected by CVE-2025-27520 via bentoml (>=1.4.0a2, <=1.4.1)
bentoml PYPI version =1.4.0a2, =1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - ai-dynamo 0.1.0 - openllm 0.6.19 Source cves: CVE-2025-27520 Source advisory: SNYK:PYTHON-BENTOML-9667321...
ai-dynamo (0.1.0), openllm (0.6.19) potentially affected by CVE-2025-27520 via bentoml (>=1.4.0a2, <=1.4.1)
bentoml PYPI version =1.4.0a2, =1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - ai-dynamo 0.1.0 - openllm 0.6.19 Source cves: CVE-2025-27520 Source advisory: OSV:GHSA-33XW-247W-6HMC...
Deserialization of Untrusted Data
Overview bentoml is a BentoML: Build Production-Grade AI Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserializevalue function, which is accessible over the /summarize endpoint. An attacker can execute code on the server by sending a...
ai-dynamo (0.1.0), openllm (0.6.19) potentially affected by CVE-2025-27520 via bentoml (>=1.4.0a2, <=1.4.1)
bentoml PYPI version =1.4.0a2, =1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - ai-dynamo 0.1.0 - openllm 0.6.19 Source cves: CVE-2025-27520 Source advisory: GHSA-33XW-247W-6HMC...
CVE-2025-27520
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520
BentoML 1.4.2 contains an insecure deserialization flaw in serde.py that enables unauthenticated RCE via crafted payloads. The issue, described across CVE-2025-27520 sources, is fixed in 1.4.3. Public PoCs and exploit modules exist (GitHub, Metasploit) illustrating remote command execution attemp...
CVE-2025-27520
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
ai-dynamo (0.1.0), openllm (0.6.19) potentially affected by CVE-2025-27520 via bentoml (>=1.4.0a2, <=1.4.1)
bentoml PYPI version =1.4.0a2, =1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - ai-dynamo 0.1.0 - openllm 0.6.19 Source cves: CVE-2025-27520 Source advisory: MEND:CVE-2025-27520...
PT-2025-14902
Name of the Vulnerable Software and Affected Versions BentoML versions 1.3.8 through 1.4.2 Description A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in BentoML. It allows any unauthenticated user to execute arbitrary code on the server. The...
BentoML code-related vulnerabilities
BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable AI applications using Python. A code issue vulnerability exists in BentoML version 1.3.4 through versions prior to 1.4.3, which stems from an insecure deserialization iss...
CVE-2025-27520: Deserialization of Untrusted Data
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
BentoML RCE
A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in v1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. Module Options msf use exploit/linux/http/bentoml/rcecve202527520 msf undefinedrcecve202527520 show...
Deserialization Of Untrusted Data
BentoML is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unsafe deserialization due to the runner server automatically deserializing input when the args-number parameter is greater than 1, allowing an attacker to execute arbitrary code...