CVE-2026-112264

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

EUVD-2026-104309

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-112264

BentoML versions through 1.4.39 are vulnerable to a Dockerfile instruction injection vulnerability (CWE-78). The root cause is the lack of proper sanitization of docker.env mapping keys rendered by the legacy base.j2 template, which allows attackers to embed newlines into the configuration. By pr...