PT-2026-53390

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

PT-2026-53391

An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution RCE by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is...

PT-2026-53389

Summary A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest versionv1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. Details It exists an unsafe code segment in serde.py: Python def deserialize...

agent-os-py (>=0.0.1, <=0.1.1), agl-ocr-reader (1.1.1) +13 more potentially affected by CVE-2026-54282 via starlette (0.28.0)

starlette PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agent-os-py =0.0.1, =1.0.22, =0.4.4, =2023.8.0b1, =6.1.8, =0.1.25, =0.1.0a3, =0.1.0a11 Source cves: CVE-2026-54282 Source advisory:...

agent-os-py (>=0.0.1, <=0.1.1), agl-ocr-reader (1.1.1) +13 more potentially affected by CVE-2026-48818 via starlette (0.28.0)

starlette PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agent-os-py =0.0.1, =1.0.22, =0.4.4, =2023.8.0b1, =6.1.8, =0.1.25, =0.1.0a3, =0.1.0a11 Source cves: CVE-2026-48818 Source advisory:...

CVE-2026-44345

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

CVE-2026-44346

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...

ersilia (>=0.0.5, <=0.1.1) potentially affected by CVE-2026-44345 via bentoml (0.11.0)

bentoml PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - ersilia =0.0.5, =0.1.1 Source cves: CVE-2026-44345 Source advisory: OSV:PYSEC-2026-189...

PYSEC-2026-189

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

CVE-2026-44345

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

ai-dynamo (>=0.1.0, <=0.3.0), bentoctl (0.2.3) +6 more potentially affected by CVE-2026-44346 via bentoml (>=1.0.0a7, <=1.4.8)

bentoml PYPI version =1.0.0a7, =0.1.0, =1.0.1, =0.3.12.dev20240709150559, =0.0.1, =1.0.3, =0.0.10, =0.6.30 - raptor-labsdk 0.3.2 Source cves: CVE-2026-44346 Source advisory: OSV:PYSEC-2026-190...

bentoutils (>=0.0.35, <=0.1.1), qandaxfmrartifact (>=0.0.6, <=0.0.7) +3 more potentially affected by CVE-2026-44346 via bentoml (0.10.1)

bentoml PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bentoutils =0.0.35, =0.0.6, =0.0.5, =0.0.3, =0.0.4 Source cves: CVE-2026-44346 Source advisory: OSV:PYSEC-2026-190...

openlayer (0.0.0a0), sentencebertservice (20211205152102.0.0) +1 more potentially affected by CVE-2026-44346 via bentoml (0.13.1)

bentoml PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - openlayer 0.0.0a0 - sentencebertservice 20211205152102.0.0 - unboxapi =0.1.1, =0.3.0 Source cves: CVE-2026-44346 Source advisory: OSV:PYSEC-2026-...

ai-dynamo (>=0.1.0, <=0.3.0), bentoctl (0.2.3) +6 more potentially affected by CVE-2026-44345 via bentoml (>=1.0.0a7, <=1.4.8)

bentoml PYPI version =1.0.0a7, =0.1.0, =1.0.1, =0.3.12.dev20240709150559, =0.0.1, =1.0.3, =0.0.10, =0.6.30 - raptor-labsdk 0.3.2 Source cves: CVE-2026-44345 Source advisory: OSV:PYSEC-2026-189...

bentoutils (0.0.10), ersilia (>=0.0.1, <=0.0.3) +3 more potentially affected by CVE-2026-44345 via bentoml (0.9.2)

bentoml PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bentoutils 0.0.10 - ersilia =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-44345 Source advisory: OSV:PYSEC-2026-189...

bento2seldon (>=0.1.0, <=0.4.0), bento2seldon4recsys (>=0.1.0, <=0.1.3) potentially affected by CVE-2026-44345 via bentoml (0.12.1)

bentoml PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bento2seldon =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-44345 Source advisory: OSV:PYSEC-2026-189...

openlayer (0.0.0a0), sentencebertservice (20211205152102.0.0) +1 more potentially affected by CVE-2026-44345 via bentoml (0.13.1)

bentoml PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - openlayer 0.0.0a0 - sentencebertservice 20211205152102.0.0 - unboxapi =0.1.1, =0.3.0 Source cves: CVE-2026-44345 Source advisory: OSV:PYSEC-2026-...

PYSEC-2026-190

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...

ersilia (>=0.0.5, <=0.1.1) potentially affected by CVE-2026-44346 via bentoml (0.11.0)

bentoml PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - ersilia =0.0.5, =0.1.1 Source cves: CVE-2026-44346 Source advisory: OSV:PYSEC-2026-190...

bento2seldon (>=0.1.0, <=0.4.0), bento2seldon4recsys (>=0.1.0, <=0.1.3) potentially affected by CVE-2026-44346 via bentoml (0.12.1)

bentoml PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on bentoml and may be impacted: - bento2seldon =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-44346 Source advisory: OSV:PYSEC-2026-190...