PYSEC-2026-295 BentoML deserialization vulnerability

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

BentoML deserialization vulnerability

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

PT-2025-12264

Name of the Vulnerable Software and Affected Versions bentoml/bentoml versions prior to 1.3.4.post1 Description A deserialization issue exists in the BentoML runner server. By configuring specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm...