day09-bentoml-deser-lab

Dia 09 — CVE-2025-27520 desserialização insegura estilo BentoML — Laboratório Docker Local Este laboratório reproduz a classe de desserialização insegura que levou ao CVE-2025-27520. Ele é intencionalmente vulnerável para fins educacionais. Execute apenas localmente no Docker. Início rápido...

CVE-2025-27520-PoC

CVE-2025-27520 — Simulazione educativa sicura / PoC Demo Stand ⚠️ Importante: Questa è una simulazione educativa sicura della vulnerabilità CVE-2025-27520. Il progetto include un servizio simulato Flask e uno scanner PoC sicuro Python. La simulazione crea un file di prova in data/ quando riceve un...

📄 BentoML 1.4.2 Remote Code Execution

A remote code execution vulnerability caused by insecure deserialization has been identified in version 1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. This module requires Metasploit: https://metasploit.com/download Current source:...

BentoML Vulnerability Allows Remote Code Execution on AI Servers

TL;DR: A critical deserialization vulnerability CVSS 9.8 - CVE-2025-27520 in BentoML v1.3.8–1.4.2 lets attackers execute remote code without…...

CVE-2025-27520

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520

BentoML 1.4.2 contains an insecure deserialization flaw in serde.py that enables unauthenticated RCE via crafted payloads. The issue, described across CVE-2025-27520 sources, is fixed in 1.4.3. Public PoCs and exploit modules exist (GitHub, Metasploit) illustrating remote command execution attemp...

CVE-2025-27520

creationtimestamp| type| source ---|---|--- 2025-04-04 00:59:47+00:00| published-proof-of-concept| https://github.com/bentoml/BentoML/security/advisories/GHSA-33xw-247w-6hmc 2025-04-04 15:15:09+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114280346981280788 2025-04-04 15:15:09+00:00|...